The China-linked threat actor ‘Warlock’ continues to weaponize Microsoft SharePoint vulnerabilities, including both known and potentially new flaws, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. Recent targets include critical infrastructure, government, and education sectors. The group exploits these SharePoint vulnerabilities to gain initial access, disable security tools, and deploy ransomware. This activity highlights the persistent threat posed by state-sponsored groups using cybercrime tactics.