Threat actor
FIN11
Tracked by CyberSIXT since 2 Oct · last activity 3 Oct
Also WarlockMalpedia
- CVEs linked · all time
- 5
- in CISA KEV · all time
- 4
- articles · all time
- 2
2 articles since 11 Sep.
Show as table
| Day (UTC) | Articles |
|---|---|
| Fri 2 Oct | 1 |
| Sat 3 Oct | 1 |
CVEs
5 CVEsCVE-2026-50522Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited3.0%EPSS10articles
CVE-2026-58644Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited16%EPSS14articles
CVE-2026-55040Microsoft SharePoint Weak Authentication VulnerabilityCVSS9.1CriticalExploited70%EPSS16articles
CVE-2026-32201Microsoft SharePoint Server Improper Input Validation VulnerabilityCVSS6.5MediumExploited43%EPSS14articles
CVE-2025-1055K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-Privilege UserCVSS5.6Medium–Not in KEV0.2%EPSS2articles
- China-linked Warlock Exploits SharePoint to Deploy Ransomware Against Critical SectorsThe Hacker News
- Warlock Ransomware Expands SharePoint Attacks Against Critical SectorsSecurityWeek · first in our coverage