Warlock

Warlock is a ransomware operation active since at least March 2025, with public victim postings beginning in June 2025. It has been tracked as GOLD SALEM by Sophos and is closely associated with the threat actor Storm-2603, which Microsoft has assessed with moderate confidence as China-based, although that geographic attribution is not universally corroborated. Warlock has targeted organizations across multiple regions including North America, Europe, South America, Latin America, and Asia-Pacific, with observed victims spanning government, telecommunications, agriculture, energy and natural resources, and commercial enterprises.

Warlock intrusions have repeatedly been linked to exploitation of internet-facing on-premises Microsoft SharePoint vulnerabilities, especially the ToolShell exploit chain, and later reporting also associates the operation with exploitation of other enterprise software vulnerabilities. In observed SharePoint compromises, attackers obtained code execution on vulnerable servers, deployed web shells for command execution, stole credentials from LSASS using Mimikatz, created local and domain administrative accounts, and moved laterally with tools such as PsExec, Impacket, WMI, and PowerShell remoting. Microsoft also observed modification of Group Policy Objects to distribute the ransomware payload across compromised environments.

The operation demonstrates mature post-compromise tradecraft beyond encryption. Reported activity includes persistence through web shells, scheduled tasks, IIS component manipulation, and secondary backdoors; use of remote access channels such as Cloudflare tunneling, Zoho Assist, OpenSSH, and Visual Studio Code tunnels; and data theft and leak-site extortion. Warlock maintains a Tor-based leak site and has published victim names and stolen data, indicating a double-extortion model in which exfiltration is an important component of operations.

Defense evasion is a notable feature of Warlock-linked intrusions. Researchers have observed Bring Your Own Vulnerable Driver techniques used to disable or tamper with endpoint security products, including vulnerable antivirus or utility drivers and, in later reporting, DLL sideloading chains used to load signed vulnerable drivers for mass termination of endpoint agents. Additional observed tooling across Warlock-related incidents includes Velociraptor, Cobalt Strike, Rclone, and other utilities associated with reconnaissance, credential access, remote administration, and exfiltration.

Warlock appears both as a distinct ransomware brand and as malware deployed by overlapping or multi-actor intrusion sets. Incident reporting has described environments where Storm-2603 activity overlapped with unrelated actors, complicating attribution. Even so, the strongest consistent pattern is exploitation of exposed enterprise services for initial access, rapid privilege escalation and lateral movement, suppression of defenses, theft of data, and enterprise-wide ransomware deployment.