Warlock

Warlock is a ransomware threat group first observed in 2025 and also tracked as Storm-2603 and GOLD SALEM. It is distinct from the older Warlock Dark Army name despite the similarity. The group is notable for combining ransomware operations with aggressive exploitation of internet-facing enterprise software, including zero-day and n-day vulnerabilities affecting edge and collaboration platforms. Reporting has linked Warlock to exploitation activity involving Microsoft SharePoint, SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack, and characterized it as a likely China-based operator. Warlock has targeted high-value organizations across sectors including government, aerospace, nuclear energy, healthcare, and other enterprise environments. Publicly claimed victims and incident reporting indicate activity against organizations in multiple countries, including China, Australia, and the United Kingdom. The group has been associated with attacks on service providers and large enterprises, and has reportedly compromised dozens of organizations within a relatively short operating period. Operationally, Warlock relies heavily on defense evasion before ransomware deployment. It has repeatedly used bring-your-own-vulnerable-driver techniques and multiple EDR-killer utilities in the same intrusion to disable endpoint protections at kernel level. HexKiller was previously assessed as closely associated with Warlock, and the group has also been linked to use of several signed vulnerable drivers to terminate security products. Reporting further indicates use of DLL sideloading chains to load vulnerable drivers and impair endpoint agents at scale. Observed Warlock tradecraft spans the full ransomware lifecycle: exploitation of exposed applications for initial access; deployment of remote management and remote access tooling for persistence and hands-on-keyboard control; credential theft using post-compromise tooling; lateral movement with administrative protocols and offensive frameworks; and data exfiltration prior to ransomware execution. Warlock operators have been observed using legitimate remote administration software, cloud services, and dual-use tooling to blend into victim environments. In at least one incident, operators deployed unattended remote-management software to maintain covert administrative access. Warlock appears to operate with a financially motivated ransomware model, including public victim claims and a leak site. The group remained operational into 2026 even after periods of reduced public posting, while continuing to expand its technical arsenal and anti-EDR capabilities.