Plan ahead High Check your exposure
Warlock ransomware group hit a water utility, likely through SharePoint
CyberScoopMicrosoft, SharePoint · water, telecommunications
What happened. Researchers reported on 1 October that the China-linked group behind Warlock ransomware attacked at least four organisations in two months, including a water utility and a telecoms provider. The likely way in was on-premises SharePoint, using flaws patched in July 2025 and newer ones.
Who is affected. A water utility, a telecommunications provider, a regional government body and a university in Portuguese- and Spanish-speaking countries. Servers running on-premises Microsoft SharePoint are the likely entry point.
What to do. Check whether you run on-premises Microsoft SharePoint and confirm all fixes, including the July 2025 ToolShell fixes, are applied. Also confirm your security tools are running.
When to act. Plan ahead: review your exposure to the same entry point
Editor's reading
Forasset ownerdetection engineerIT security
- Purdue level
- L4
Why: On-premises SharePoint is an enterprise business server (L4). The utility's operational systems are not described as affected.
- Are you exposed?
Check for on-premises SharePoint servers reachable from the internet and verify each has the 2025 ToolShell fixes and later updates.
- If you cannot fix it yet
- Restrict internet access to on-premises SharePoint, or put it behind a VPN with multi-factor authentication.
- Separate IT and OT networks so a compromised SharePoint server cannot reach plant systems.
- Alert when security tools are stopped or stop reporting on servers.
- Watch for
- Security tools or agents being stopped or disabled on servers before any encryption starts.
- New web shells or unexpected files on SharePoint servers, and unusual logons from them to other hosts.
- ATT&CK for ICS
- T0819Exploit Public-Facing Application
Inferred from the facts above, not stated by the source. Check it against your own site before acting.