Daily Brief
SharePoint attacks and academic espionage
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Warlock is still using Microsoft SharePoint vulnerabilities to disable security tools and deploy ransomware, with attacks reported against critical infrastructure, government and education organisations in Portuguese- and Spanish-speaking countries. It matters because it shows both old and new SharePoint flaws remain practical entry points for ransomware activity.
Audit exposed SharePoint instances this week, apply the latest fixes, and verify whether security tools can still be disabled from the application layer.
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
TA419 is running credential phishing campaigns against AI experts in US think tanks, universities and legal sector organisations, using Microsoft AitM phishing and impersonation of economists, AI policymakers and an Anthropic employee. This matters because the targeting is narrow and the lure is tailored to people likely to handle sensitive policy and research work.
Warn staff in policy, research and legal roles to treat unsolicited collaboration requests as hostile, and make phishing-resistant sign-in the default where possible.