CiberLATAMbywhalemate

#ToolShell

This tag brings together reporting on a technique or attack vector tied to intrusions, exploitation, and follow-on activity inside corporate environments. Readers will find analysis of detection, mitigation, incident response, and exposure signals relevant to organizations across Latin America.

Warlock exploited SharePoint in critical attacks

Symantec tied Warlock to a SharePoint on-prem intrusion that stole ASP.NET keys, disabled defenses and spread through SYSVOL.

Oct 21, 2026 · 38 min