Do Son Symantec exposed Warlock ransomware (a probable Anylock rebrand) used by China-linked Storm-2603. It exploits the SharePoint zero-day and BYOVD to disable security and encrypt files with the .x2anylock extension.
CVE-2025-53770
Microsoft warns of active zero-day exploitation (CVE-2025-53770, CVSS 9.8) in on-premises SharePoint Server. No patch is available, but mitigations are provided.