The attack chain centers on exploiting SharePoint to gain a foothold, after which the operators work to disable security tooling before deploying ransomware. This combination of defense evasion followed by encryption is a familiar playbook for financially motivated intrusion sets that also carry out espionage-adjacent operations.

Key points from the reporting:

• Targeted sectors include critical infrastructure, government, and education
• Victims are concentrated in Portuguese- and Spanish-speaking regions
• The actor is assessed as China-linked
• Both older and potentially new SharePoint flaws are being exploited
• Security tools are disabled prior to ransomware deployment

Organizations running on-premises SharePoint should prioritize patching and review exposure of their instances, particularly if they operate in the affected regions or sectors. Monitoring for unexpected disabling of endpoint security services can provide an early warning before ransomware is deployed.

Source: The Hacker News

Has your organization reviewed its SharePoint exposure or seen signs of defense-evasion activity tied to this campaign?