Warlock

Warlock is a ransomware family active since at least March 2025 and publicly advertised from June 2025. It has been associated with the threat cluster tracked as Storm-2603 by Microsoft and GOLD SALEM by Sophos. Multiple investigations link Warlock activity to exploitation of internet-facing enterprise software, especially on-premises Microsoft SharePoint through the ToolShell vulnerability chain, and also to compromises involving other exposed applications. Observed victims span government, healthcare, manufacturing, telecommunications, agriculture, energy and natural resources, and other commercial sectors across North America, Europe, South America, Latin America, and Asia-Pacific.

Warlock intrusions commonly involve exploitation of public-facing applications for initial access, followed by deployment of web shells or other remote-access tooling, credential theft, lateral movement, defense evasion, data exfiltration, and ransomware deployment. Reported post-compromise tradecraft includes theft of credentials from LSASS, use of PsExec, Impacket, WMI, RDP, WinRM, and Group Policy Objects for propagation and payload distribution. Operators have also used legitimate or dual-use remote management and incident-response tools such as Zoho Assist and Velociraptor to maintain access and blend into administrative activity.

Defense evasion is a notable feature of Warlock operations. Observed campaigns used Bring Your Own Vulnerable Driver techniques to tamper with or terminate endpoint security products, and some reporting also describes DLL sideloading chains used to load vulnerable signed drivers for broad endpoint-agent disruption. Persistence mechanisms seen in Warlock-linked intrusions include web shells, scheduled tasks, remote management agents, and tunneling or remote-access channels established through administrative tooling.

Warlock is also tied to double-extortion style operations. Victim organizations have been listed on a leak site, and reporting links some intrusions both to ransomware deployment and to data theft followed by publication or sale claims. The group’s operational model appears compatible with extortion-focused ransomware activity rather than encryption alone.

Microsoft has assessed Storm-2603 with moderate confidence as China-based, but that attribution has not been universally corroborated. What is well supported is the repeated association between Storm-2603/GOLD SALEM and Warlock deployments, particularly in attacks exploiting on-premises SharePoint vulnerabilities and using GPO-based ransomware rollout inside compromised Windows environments.