Warlock
The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.
Extension(s): .x2anylock
Victims
78
First Discovered
2025-06-11
victim
Last Discovered
2025-11-06
victim
Inactive Since
151
days
Avg Delay
26.6
days
Infostealer
32.7%
victims with domain
Known Locations (4)
Target (Available)
Top 5 Activity Sectors
- Technology 20
- Financial Services 3
- Telecommunication 3
- Agriculture and Food Production 2
- Manufacturing 2
Top 5 Countries
-
United States
12
-
Japan
5
-
Russian Federation
5
-
United Kingdom
4
-
Türkiye
2
Heatmap (Available)
Ransom Notes (2)
Tools Used (Available)
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
SecurityCheck
|
Radmin
|
VMTools AV Killer (BYOVD)
|
Mimikatz
Veeam-Get-Creds
|
Velociraptor
|
Cloudflared
OpenSSH
MinIO
VS Code Tunnel
|
Minidump
|
|
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (0)
No TTPs available.
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (0)
No YARA rules available.
Indicators of Compromise (IoCs) (4)
SHA256
1
TOX
3
Victims (78)
165g data, including internal documents, financial documents, employee information, CRM database, HR…
This is only a part of the files and file list. The full set of files needs to be purchased separate…
[AI generated] BrightWork.com is a project management software company that provides solutions for t…
[AI generated] Via Optronics is a global technology company that specializes in the production of in…
[AI generated] Nippon India Mutual Fund (NIMF), previously known as Reliance Mutual Fund, is one of …
