Warlock Ransomware

Who Warlock is

The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.

Recorded activity

Disclosures attributed to Warlock in this database run from June 2025 to November 2025, totalling 78 victims — 0.4% of everything tracked here. Warlock has listed victims in 34 countries in this database, most often United States, followed by United Kingdom and Russia. The sectors appearing most in its listings are Technology, Financial Services, Construction.

Tooling observed in Warlock operations

• Mimikatz
• Veeam-Get-Creds
• Everything.exe
• SecurityCheck
• RClone
• Minidump
• Msiexec
• PsExec
• RDP Patcher
• Azure Blog Storage
• Catbox[.]moe
• Cloudflared

Software reported in use by Warlock. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.

Indicators of compromise

• da8de7257c6897d2220cdf9d4755b15aeb38715807e3665716d2ee761c266fdb

Showing a sample of 1 SHA256 on file. Hashes and network indicators published for Warlock. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
warlock ransomware
*/

rule warlock_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.warlock"
        description = "Detects warlock ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "warlock" ascii nocase
        $name2 = "WARLOCK" ascii
        $onion  = "warlock.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Warlock, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.