On October 3, 2026, The Hacker News reported China-linked, Warlock, Microsoft SharePoint. The framing is mine. Their sentences stay on their page.
The names I am willing to repeat are China-linked, Warlock, Microsoft SharePoint, Portuguese-. The subject words I am keeping are ransomware, sharepoint.
I am staying on the public report. No shop links and no how-to.
Source I used: The Hacker News. The link is under this column.