China-Linked Warlock Ransomware Operation Targets Water Utility, Telecom, and University in Portuguese- and Spanish-Speaking Countries

The China-linked Warlock ransomware operation has attacked at least four organizations in Portuguese- and Spanish-speaking countries over the past two months, including a water utility, a telecommunications provider, a regional government body, and a university, Symantec researchers said. The attackers gained access by exploiting vulnerabilities in on-premises Microsoft SharePoint servers, including older ToolShell flaws and newer vulnerabilities. In one intrusion, attackers disabled security software on at least 40 systems before deploying ransomware on at least 33, according to Symantec’s analysis. To maintain stealthy remote access, the group installed Visual Studio Code Insiders as a service and used its built-in tunneling feature to blend in with developer or administrator traffic. Network rollout was achieved by staging the ransomware in the domain’s SYSVOL share, which replicates across domain controllers, enabling network-wide deployment through logon scripts or Group Policy.

You’re reading about a ransomware attack on water utilities and telecoms in three continents, and the mainstream narrative wants you to believe it’s just another criminal nuisance. But ask yourself: who exactly stands to gain when the systems that keep a society alive—clean water, communications, governance—are shown to be dangerously fragile? Look at the modus operandi here: the attackers didn’t just smash their way in; they used old SharePoint vulnerabilities that have been documented and ignored for years. Those holes are not accidents. The institutions responsible for patching them are the same institutions that sign off on annual cybersecurity budgets, the same board members who sit on multiple foundation boards, the same executives who rotate through government advisory roles. The fact that these servers were left exposed isn’t negligence—it’s design. They need the public to believe that our infrastructure is perpetually on the brink, because that manufactured crisis justifies the next wave of surveillance mandates, centralized control, and “public-private partnerships” that hand the keys to the very networks that profit from the chaos.

Now read the fine print of the attack chain. The group installed Visual Studio Code Insiders as a service and used its tunneling feature to blend in with legitimate developer traffic. That’s not a script kiddie trick—that’s tradecraft that someone studied, rehearsed, and deployed with surgical precision. And where did they stage the ransomware? In the domain’s SYSVOL share, a built-in Windows mechanism that replicates across every connected machine. This is the same pattern we saw in the NotPetya and SolarWinds campaigns: a calculated demonstration that the digital backbone of critical infrastructure is wide open, not because of incompetence, but because the permissions and architectures were designed by the same globalist engineers who later sell the “solutions.” Open the World Economic Forum’s 2020 Global Risk Report, page 47—you’ll find a cleanly worded warning about “critical information infrastructure fragility” followed by a recommendation for “cross-sector governance integration.” That’s the blueprint. The ransomware is the rehearsal.

Here is what they won’t tell you about the victims: a water utility, a telecom, a regional government, a university. That’s not random—it’s a cross-section of every layer of society that must be tamed before the Architecture of Consent is complete. Water gives them control over survival; telecom gives them control over narrative; government gives them control over policy; universities give them control over the next generation’s worldview. The China-linked attribution is a distraction—ask instead who funds Symantec, who sits on their parent company’s board, and why this report came out just as a new global cybersecurity treaty is being drafted. The threat is real, but the threat actors are being used. The attack on the water utility wasn’t about extortion; it was a stress test to see how fast a population panics when their tap is threatened. They want you to fear the attacker so you beg for the savior. Document this. Search the registrar of the domains used in the command-and-control infrastructure. Look at the incorporation dates of the shell companies that own those IP blocks. The truth is already in front of you—you just have to be willing to see that the pattern runs deeper than any single incident.