Microsoft says Warlock ransomware deployed in SharePoint attacks as governments scramble Chinese hackers are exploiting a new vulnerability in Microsoft SharePoint products to deploy ransomware, increasing the pressure on governments around the world as they race to assess any damage done to their systems. In an update on Wednesday night, Microsoft said a China-based actor it identifies as Storm-2603 is now deploying Warlock ransomware after exploiting CVE-2025-49706. The ransomware has only been around since June after advertisements for it — which were titled “if you want a lamborghini, please call me” — emerged on Russian cybercrime forum RAMP. Recorded Future ransomware expert Allan Liska said the group behind Warlock is a ransomware-as-a-service operation with at least 11 victims so…