Warlock ransomware

Who Warlock is

The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.

Recorded activity

Disclosures attributed to Warlock in this database run from June 2025 to November 2025, totalling 78 victims — 0.3% of everything tracked here. Warlock has listed victims in 34 countries in this database, most often United States, followed by United Kingdom and Japan. The sectors appearing most in its listings are Technology, Financial Services, Construction.

Vulnerabilities Warlock is recorded exploiting

• CVE-2026-23760 — SmarterTools SmarterMail (CRITICAL 9.8) · CISA KEV (patch due 16 Feb 2026)
• CVE-2025-40551 — SolarWinds Web Help Desk (CRITICAL 9.8) · CISA KEV (patch due 6 Feb 2026)
• CVE-2025-53770 — MS Server Products SharePoint Server (CRITICAL 9.8) · CISA KEV (patch due 21 Jul 2025)
• CVE-2025-49704 — MS Server Products SharePoint Server (HIGH 8.8) · CISA KEV (patch due 23 Jul 2025)
• CVE-2026-45659 — MS Server Products SharePoint Server (HIGH 8.8) · CISA KEV (patch due 4 Jul 2026)
• CVE-2025-14611 — CentreStack Gladinet CentreStack (HIGH 7.1) · CISA KEV (patch due 5 Jan 2026)
• CVE-2025-49706 — MS Server Products SharePoint Server (MEDIUM 6.5) · CISA KEV (patch due 23 Jul 2025)
• CVE-2025-53771 — MS Server Products SharePoint Server (MEDIUM 6.5)

7 of these 8 are in the CISA Known Exploited Vulnerabilities catalog, 5 of them recorded by CISA as used in ransomware campaigns. CVEs attributed to Warlock in threat intelligence reporting. Patching these does not by itself rule the group out, and their presence here is not evidence of how any single organisation was reached.

Tooling observed in Warlock operations

• Mimikatz
• Veeam-Get-Creds
• Everything.exe
• SecurityCheck
• RClone
• Minidump
• Msiexec
• PsExec
• RDP Patcher
• Azure Blog Storage
• Catbox[.]moe
• Cloudflared

Software reported in use by Warlock. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.

Indicators of compromise

• da8de7257c6897d2220cdf9d4755b15aeb38715807e3665716d2ee761c266fdb

Showing a sample of 1 SHA256 on file. Hashes and network indicators published for Warlock. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
warlock ransomware
*/

rule warlock_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.warlock"
        description = "Detects warlock ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "warlock" ascii nocase
        $name2 = "WARLOCK" ascii
        $onion  = "warlock.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Warlock, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.