SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefSunday, October 04, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Warlock Exploits SharePoint to Deploy Ransomware | CRITICAL |
|
5 C2 IPs | 86 OTX IOCs | 9 ARTICLES |
|
■ ANALYST TLDR Today's threat landscape is highlighted by the China-linked threat actor Warlock actively exploiting Microsoft SharePoint vulnerabilities to disable security tools and deploy ransomware. Additionally, Fortra has issued urgent patches for critical authentication bypass and remote execution vulnerabilities in its BoKS access control product. Meanwhile, MI5 has issued a warning regarding Chinese state intelligence (MSS) funding academic research to compromise intellectual property and boost espionage capabilities. |
|
■ CRITICAL STORIES Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware The China-linked threat actor Warlock is actively exploiting Microsoft SharePoint vulnerabilities to disable security tools and deploy ransomware in Portuguese- and Spanish-speaking countries, posing an immediate threat to enterprise document management systems. |
Fortra Patches Critical Vulnerabilities in BoKS Fortra has released patches for critical vulnerabilities in its BoKS access control software that could lead to authentication bypass, shell command execution, and memory corruption, allowing complete system takeover. |
Danish university DTU breach exposes data of up to 200,000 people The Technical University of Denmark (DTU) suffered a major data breach after threat actors compromised its identity and access management (IAM) system, exposing sensitive data belonging to approximately 200,000 users. |
MI5 Says China’s MSS Funded Research Involving 100+ U.K.-Linked Academics The UK's MI5 has issued an espionage alert warning that China's Ministry of State Security (MSS) has funded research involving over 100 UK-linked academics to covertly boost Beijing's military and intelligence-gathering capabilities. |
|
■ CVEs IDENTIFIED [CVE-TBD] Fortra BoKS — Authentication bypass, shell command execution, and memory corruption leading to system compromise. |
[CVE-TBD] Microsoft SharePoint — Vulnerability exploitation leading to security tool disablement and ransomware deployment. |
|
■ THREAT ACTORS Warlock | APT (China-linked) |
Exploiting Microsoft SharePoint vulnerabilities to disable security tools and deploy ransomware. |
MSS (Ministry of State Security) | Nation-State (China) |
Funding academic research involving 100+ UK-linked academics to harvest intelligence. |
ShinyHunters | Cybercrime / Extortion |
A prominent member known as "Rey" was detained in Jordan and is cooperating with the FBI. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Warlock exploiting Microsoft SharePoint vulnerabilities; potential exploitation of Fortra BoKS. |
| T1562.001 | | Impair Defenses: Disable or Modify Tools | Warlock disabling security tools prior to ransomware deployment. |
| T1486 | | Data Encrypted for Impact | Warlock deploying ransomware to encrypt victim systems. |
| T1078 | | Valid Accounts | Compromise of DTU's Identity and Access Management (IAM) system. |
| T1584 | | Compromise Infrastructure | MSS funding academic research to acquire intelligence and dual-use technology. |
|
■ PATCH PRIORITY Fortra — BoKS — Critical vulnerabilities allow authentication bypass and shell command execution — SecurityWeek |
Microsoft — SharePoint — Exploited in the wild by Warlock to disable security tools and deploy ransomware — The Hacker News |
VirusTotal — YARA-X — Version 1.21.0 contains 4 bugfixes and 5 improvements — SANS |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch all Microsoft SharePoint installations immediately to mitigate the risk of Warlock exploiting known and zero-day vulnerabilities to deploy ransomware. |
| 2 | [P1] Apply the latest security patches for Fortra BoKS to remediate critical authentication bypass and shell command execution vulnerabilities. |
| 3 | [P2] Audit and secure Identity and Access Management (IAM) systems, particularly in academic and public sector institutions, following the DTU data breach. |
| 4 | [P2] Implement strict application permission controls on macOS devices to prevent unauthorized file and system access by AI tools like Google Gemini. |
| 5 | [P3] Review academic research partnerships and funding sources for potential alignment with foreign intelligence services, in line with the MI5 MSS espionage alert. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |