BleepingComputer reports that Warlock, a ransomware group described as China-linked, gained initial access to a water utility, a telecom provider, a regional government body and a university by exploiting vulnerabilities in SharePoint.

Four victims in four sectors. The reporting does not suggest the group chose them for who they were. It suggests the group chose them for what they were running.

A ransomware crew with a national label would normally be expected to show a pattern in its targets: a ministry, a defence supplier, a bank. This one has a water utility and a university on the same list, which is the profile of an actor working through a list of reachable servers and reading the victim names afterwards.

SharePoint is where organisations keep contracts, procedures, staff directories and, in practice, a good deal of what a ransomware operator would want to read before encrypting anything. The BleepingComputer report names the product as the way in. It does not name the flaws in the material available here, so the version question has to be answered from your own inventory.

The same week, The Hacker News described a separate China-nexus campaign against government and policy organisations across Asia, with a backdoor called Antino that talks through Outlook and OneDrive. Different actor behaviour, same habit: both lean on Microsoft services that sit inside the trusted perimeter.

The control that matters is unglamorous. Any SharePoint server answering from the public internet, running below the current patch level, is the exposure Warlock used. If a server has to be reachable from outside, it belongs behind authentication at the edge, not behind a patch window that the change freeze keeps moving.