A China-based hacking group is deploying Warlock ransomware on Microsoft SharePoint servers vulnerable to widespread attacks targeting the recently patched ToolShell zero-day exploit chain.

Non-profit security organization Shadowserver is currently tracking over 420 SharePoint servers that are exposed online and remain vulnerable to these ongoing attacks.

“Although Microsoft has observed this threat actor deploying Warlock and Lockbit ransomware in the past, Microsoft is currently unable to confidently assess the threat actor’s objectives,” the company said in a Wednesday report.

While Microsoft has patched its software in recent days, cybersecurity researchers have already detected breaches on more than 100 servers representing 60 victims thus far

Microsoft links SharePoint attacks to three China-based groups; flaws allow code execution and data theft on unpatched systems.

APT41 targeted African IT services using SharePoint-based C2, custom malware, and credential stealers.

Microsoft warns of active SharePoint exploits affecting on-prem users; 54 victims confirmed in major attack.

Build strength without burnout by training your nervous system, not just your muscles.