Warlock Ransomware Targets Iberian Critical Infrastructure

Warlock/Storm-2603 reporting includes water, telecom, government, utilities, and higher-education victims in Spanish- and Portuguese-speaking regions. New operational detail confirms SharePoint exploitation, web shells, security-tool disabling, BYOVD, DLL sideloading, VS Code tunneling, administrator-traffic blending, and SYSVOL-based propagation across domain controllers; attribution remains uncertain.