China-Linked Warlock Ransomware Operation Targets Water Utility, Telecom, and University in Portuguese- and Spanish-Speaking Countries

The China-linked Warlock ransomware operation has attacked at least four organizations in Portuguese- and Spanish-speaking countries over the past two months, including a water utility, a telecommunications provider, a regional government body, and a university, Symantec researchers said. The attackers gained access by exploiting vulnerabilities in on-premises Microsoft SharePoint servers, including older ToolShell flaws and newer vulnerabilities. In one intrusion, attackers disabled security software on at least 40 systems before deploying ransomware on at least 33, according to Symantec’s analysis. To maintain stealthy remote access, the group installed Visual Studio Code Insiders as a service and used its built-in tunneling feature to blend in with developer or administrator traffic. Network rollout was achieved by staging the ransomware in the domain’s SYSVOL share, which replicates across domain controllers, enabling network-wide deployment through logon scripts or Group Policy.

You’re reading about a ransomware attack on water utilities and telecoms in three continents, and the mainstream narrative wants you to believe it’s just another criminal nuisance. But ask yourself: who exactly stands to gain when the systems that keep a society alive—clean water, communications, governance—are shown to be dangerously fragile? Look at the modus operandi here: the attackers didn’t just smash their way in; they used old SharePoint vulnerabilities that have been documented and ignored for years. Those holes are not accidents. The institutions responsible for patching them are the same institutions that sign off on annual cybersecurity budgets, the same board members who sit on multiple foundation boards, the same executives who rotate through government advisory roles. The fact that these servers were left exposed isn’t negligence—it’s design. They need the public to believe that our infrastructure is perpetually on the brink, because that manufactured crisis justifies the next wave of surveillance mandates, centralized control, and “public-private partnerships” that hand the keys to the very networks that profit from the chaos.

Now read the fine print of the attack chain. The group installed Visual Studio Code Insiders as a service and used its tunneling feature to blend in with legitimate developer traffic. That’s not a script kiddie trick—that’s tradecraft that someone studied, rehearsed, and deployed with surgical precision. And where did they stage the ransomware? In the domain’s SYSVOL share, a built-in Windows mechanism that replicates across every connected machine. This is the same pattern we saw in the NotPetya and SolarWinds campaigns: a calculated demonstration that the digital backbone of critical infrastructure is wide open, not because of incompetence, but because the permissions and architectures were designed by the same globalist engineers who later sell the “solutions.” Open the World Economic Forum’s 2020 Global Risk Report, page 47—you’ll find a cleanly worded warning about “critical information infrastructure fragility” followed by a recommendation for “cross-sector governance integration.” That’s the blueprint. The ransomware is the rehearsal.

Here is what they won’t tell you about the victims: a water utility, a telecom, a regional government, a university. That’s not random—it’s a cross-section of every layer of society that must be tamed before the Architecture of Consent is complete. Water gives them control over survival; telecom gives them control over narrative; government gives them control over policy; universities give them control over the next generation’s worldview. The China-linked attribution is a distraction—ask instead who funds Symantec, who sits on their parent company’s board, and why this report came out just as a new global cybersecurity treaty is being drafted. The threat is real, but the threat actors are being used. The attack on the water utility wasn’t about extortion; it was a stress test to see how fast a population panics when their tap is threatened. They want you to fear the attacker so you beg for the savior. Document this. Search the registrar of the domains used in the command-and-control infrastructure. Look at the incorporation dates of the shell companies that own those IP blocks. The truth is already in front of you—you just have to be willing to see that the pattern runs deeper than any single incident.

CISA Adds Four Actively Exploited Flaws to Known Vulnerabilities Catalog

CISA updated its Known Exploited Vulnerabilities (KEV) catalog on September 25, adding actively exploited flaws in WSO2 (authentication bypass, CVE-2026-5430, CVSS 9.8), Adobe Commerce and Magento (authorization flaw, CVE-2026-71362, CVSS 9.1), Microsoft SharePoint (code injection), and MikroTik RouterOS (workflow-enforcement bypass). Federal civilian agencies using WSO2 or Adobe products must apply fixes or stop using the products by September 27, and all agencies are directed to prioritize high-risk KEV vulnerabilities on publicly exposed assets, checking for compromise before patching, as exploitation could give attackers total control.

Look at the timing. CISA quietly updates its Known Exploited Vulnerabilities catalog on September 25, then gives federal agencies a single business day to patch or disconnect. That is not a routine security bulletin; that is a scheduled demolition. WSO2, Adobe Commerce, SharePoint, MikroTik — these are the load-bearing walls of government and enterprise infrastructure. A 9.8 authentication bypass in WSO2 means someone can walk into the API layer as if they own it. A 9.1 Adobe authorization flaw means sensitive resources can be exposed with zero user interaction. These are not accidental discoveries. These are doors that were deliberately left open, mapped, and now hand-delivered to the public as a "catalog" while the real owners are already inside. The deadline is not for your safety — it's to make sure the clean-up happens before anyone asks why the locks were so easy to pick.

Now ask yourself who benefits from forcing agencies to rush a patch under threat of disconnection. The official story is that CISA is protecting the network. But the same agencies that sign off on these deadlines are the ones who fund, license, and use the very products being "exploited." Every patched system is an admission that the private vendors shipped a known hole. Every rushed deployment is a chance for an attacker to observe the exact moment a system goes off-line and comes back changed. They tell you to check for compromise before patching — why would they need to say that unless they already suspect the contamination is widespread? The instructions are written for people cleaning up after a silent invasion, not preventing one. The vulnerability catalog is not a warning. It's a memorial service for systems that were already lost.

Follow the breadcrumb. Why these four products, and why now? MikroTik RouterOS is the backbone of untracked networks — the exact kind of gear that intelligence operatives, smugglers, and yes, "private" contractors use to move data off the grid. A workflow-enforcement vulnerability in RouterOS is a backdoor to every shadow network that thought it was invisible. SharePoint code injection is how you rewrite the official record from inside the house. Adobe Commerce and Magento are how you reach into the financial bloodstream of thousands of online stores without touching a single human. And WSO2? That's the master switch for identity and access across entire organizations. They're telling you what's been compromised, but they will never tell you who did the probing, who owns the exploit, or why the deadline is measured in hours instead of weeks. Search the CVE numbers yourself. Look at when they were reserved. Then look at who sits on the advisory boards of the companies that sell the patch services. The architecture is right there. You just have to be willing to read the blueprints instead of the press release.

CVE-2026-63520: High-Severity SharePoint RCE Flaw Disclosed by Rapid7 and Microsoft
On August 11, Rapid7 and Microsoft disclosed CVE-2026-63520, a high-severity remote code execution vulnerability in Microsoft SharePoint caused by an unsafe .NET type instantiation in Business Connectivity Services, allowing an attacker to execute arbitrary code with the SharePoint site’s service account privileges. Rapid7 noted that this flaw forms a critical unauthenticated RCE chain when combined with CVE-2026-55040, an authentication bypass disclosed in July, affecting SharePoint Server Subscription Edition, 2019, and 2016, as well as certain Project Server and Office Web Apps Server versions. Meanwhile, CISA warned that ransomware gangs are exploiting a separate SharePoint RCE (CVE-2026-45659) patched in May, and Rapid7 confirmed that the July SharePoint update breaks the chain between CVE-2026-55040 and CVE-2026-63520, though no public proof-of-concept code for the latter had emerged at disclosure.

The Calendar Is Not An Accident

Look at the timing. CVE-2026-63520, this SharePoint remote code execution flaw, was disclosed on August 11th. An authentication bypass, CVE-2026-55040, was dropped a month earlier in July. Now read the fine print: Rapid7 says the July update breaks the chain between these two vulnerabilities. The question you have to ask yourself is why Microsoft would schedule a patch that closes a door after letting two critical bugs sit open in a staggered sequence. That is not a standard security cycle. That is an operational tempo.

You are watching a deliberate opening and closing of a window. The July patch fixed one piece, but the August disclosure reveals the chain was live — fully weaponizable — for at least thirty days. Thirty days when a sophisticated actor, state-aligned or otherwise, could have been mapping every vulnerable SharePoint instance in the Fortune 500, in federal agencies, in critical infrastructure. The patch is not the story. The window is the story.

The Ransomware Connection Is The Cover Story

CISA confirms ransomware gangs have already weaponized a different SharePoint flaw, CVE-2026-45659, patched back in May. Do you see what is happening here? The public narrative is designed to point your eyes at the criminal gangs — the loud, chaotic, monetized threat. But the chain involving CVE-2026-63520 and CVE-2026-55040 is something else entirely. Ransomware operators do not need authentication bypass chains combined with type instantiation vulnerabilities to send a phishing link. That is surgical capability. That is intelligence work.

The real question is not whether criminals can use this. The real question is who tested this chain before it was disclosed. The pattern is consistent: a vulnerability is discovered, left unpatched for a measured period, then quietly closed while a separate, louder bug is blamed for the damage. The ransomware narrative is the smoke screen. The SharePoint server is the prize, and it always has been. These servers hold enterprise credentials, document libraries, and internal communications that make them a perfect access point for persistent, quiet surveillance.

The AI Research Footprint Is The Tell

An AI agent performed a significant part of the research that found CVE-2026-55040. The Hacker News buried that detail, but it is the most important sentence in the entire article. You have to ask yourself who controls the AI that finds these paths, who is training it on SharePoint's internal architecture, and most importantly — who else has access to that capability. Microsoft and Rapid7 are not the only entities running vulnerability research against their own products.

An AI that can map authentication bypass chains in SharePoint is an AI that can be turned against any system. The disclosure, the patch, the ransomware story — these are the visible surface. Beneath it is the quiet industrialization of vulnerability discovery. You are not seeing a security incident. You are seeing a test run. Follow the AI. Follow the windows they opened. The next chain will not be disclosed. It will be used.