The suspected China-linked Warlock ransomware group, also tracked as Longlegs, Gold Salem, and Storm-2603, continues to exploit Microsoft SharePoint vulnerabilities, including the ToolShell exploit chain, to target critical infrastructure, government, and education organizations across Portuguese- and Spanish-speaking countries in Europe, Africa, and Latin America. After compromising vulnerable on-premises SharePoint servers, Warlock operators deploy web shells, steal ASP.NET machine keys, forge signed payloads, and achieve remote code execution (RCE) before conducting reconnaissance and expanding access throughout victim networks. The group combines DLL sideloading and living-off-the-land techniques with legitimate cloud services, Visual Studio Code tunneling for remote access, and tools such as NetExec for Active Directory enumeration, credential spraying, and command execution. Warlock also uses a BYOVD technique involving the vulnerable K7RKScan.sys driver (CVE-2025-1055) to disable AV/EDR defenses; in one critical-infrastructure intrusion, security protections were disabled on at least forty (40) hosts within roughly two (2) hours before ransomware was deployed to at least thirty-three (33) systems. Attackers staged the ransomware in the domain SYSVOL share to leverage domain replication for network-wide distribution, demonstrating Warlock’s ability to rapidly transition from initial SharePoint exploitation to large-scale ransomware deployment. Researchers warn that ToolShell and other SharePoint vulnerabilities remain effective initial-access vectors against unpatched deployments, while Warlock’s recent geographic concentration may reflect either opportunistic exploitation of exposed systems or deliberate targeting of Portuguese- and Spanish-speaking organizations.