Warlock
Warlock is a ransomware family and associated extortion operation active since at least March 2025, first publicly advertised in June 2025 and tracked by Sophos CTU as GOLD SALEM and by Microsoft as Storm-2603. It has compromised networks across North America, Europe, South America, Latin America/Caribbean, and Asia-Pacific, with victims including small businesses, large multinationals, government entities, telecommunications, agriculture, energy and natural resources, and other sectors. Multiple sources describe the actor as financially motivated; Microsoft assessed Storm-2603 with moderate confidence as China-based, while Sophos stated it lacked sufficient evidence to confirm that attribution.
Observed initial access includes exploitation of internet-facing Microsoft SharePoint Server via the ToolShell exploit chain and related vulnerabilities CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, as well as exploitation of SmarterMail vulnerabilities including CVE-2026-23760 and CVE-2026-24423. Warlock-linked intrusions have also been associated with exploitation of SolarWinds Web Help Desk (CVE-2025-40551) and Gladinet CentreStack (CVE-2025-14611), and some reporting notes deployment via exposed RDP services. In SharePoint cases, attackers uploaded ASPX web shells such as spinstall0.aspx and variants spinstall.aspx, spinstall1.aspx, and spinstall2.aspx, executed commands via w3wp.exe/cmd.exe, stole SharePoint ASP.NET MachineKey material, and established persistence through web shells, scheduled tasks, and IIS component manipulation.
Post-compromise tradecraft includes credential theft with Mimikatz against LSASS, lateral movement with PsExec, Impacket, WMI, PowerShell Remoting, OpenSSH, Radmin, TightVNC, and Cobalt Strike, and ransomware distribution via modified Group Policy Objects. Warlock operators have repeatedly abused legitimate tools for persistence and access, notably Velociraptor, including installation of older vulnerable versions and use of Velociraptor to establish a Visual Studio Code tunnel. Additional observed tooling across Warlock-linked intrusions includes Everything.exe, SecurityCheck, Veeam-Get-Creds, Cloudflared, RClone, MinIO, Azure Blob Storage, Supabase, Catbox[.]moe, msiexec, and RDP Patcher.
Defense evasion is a prominent feature of Warlock activity. Observed intrusions used Bring Your Own Vulnerable Driver techniques to disable endpoint protections, including a vulnerable Baidu Antivirus driver renamed googleApiUtil64.sys exploiting CVE-2024-51324 to terminate EDR processes. Reporting also links Warlock affiliates to an msimg32.dll sideloading chain that loads signed vulnerable drivers rwdrv.sys and hlpdrv.sys to kill endpoint agents. Other BYOVD-related components observed in Warlock-linked intrusions include Antiy System In-Depth Analysis Toolkit driver, NsecSoft driver, Rising Antivirus driver, and VMTools AV Killer.
Warlock operates a Tor-based leak site and uses data theft and extortion in addition to encryption. Victim postings began in June 2025; one report states the group reached 43 total listings in Q3 2025, while Sophos reported 60 victims listed through mid-September 2025 and publication of stolen data from a subset of those victims. Some incidents and reporting emphasize data exfiltration and leak-site publication as part of the operation. Known indicators and artifacts directly mentioned in reporting include the web shell filenames above; files such as IIS_Server_dll.dll, SharpHostInfo.x64.exe, xd.exe, and debug_dev.js; the path \1[5-6]\TEMPLATE\LAYOUTS\debug_dev.js; IPs 65.38.121[.]198, 131.226.2.6, 134.199.202.205, 104.238.159.149, and 188.130.206.168; the host c34718cbb4c6.ngrok-free.app; and in SmarterMail-related activity, download of a malicious MSI named v4.msi from Supabase and a Golang-based WebSockets backdoor downloaded as c:\users\public\Sophos\Sophos-UI.exe from filebin.net.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
SharePoint Server CVE-2025-49706, CVE-2025-49704 ("ToolShell") Storm-2603 (Warlock) ... disrupting active exploitation of on-premises SharePoint vulnerabilities | This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
SmarterMail CVE-2026-23760 Storm-2603 (Warlock) ... observed during intrusions that lead to WarLock ransomware deployment or data exfiltration | This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
SharePoint Server CVE-2025-49706, CVE-2025-49704 ("ToolShell") Storm-2603 (Warlock) ... disrupting active exploitation of on-premises SharePoint vulnerabilities | This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
Gladinet CentreStack CVE-2025-14611 Storm-2603 (Warlock) ... observed during intrusions that lead to WarLock ransomware deployment or data exfiltration | This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
SolarWinds Web Help Desk CVE-2025-40551 Storm-2603 (Warlock) ... observed during intrusions that lead to WarLock ransomware deployment or data exfiltration | This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
The version of Velociraptor observed in this incident was outdated (version 0.73.4.0) and exposed to a privilege escalation vulnerability (CVE-2025-6264), which may have been leveraged for persistence as this vulnerability can lead to arbitrary command execution and endpoint takeover.
CTU researchers also observed GOLD SALEM bypass EDR by using the Bring Your Own Vulnerable Driver (BYOVD) technique and a vulnerable Baidu Antivirus driver renamed googleApiUtil64.sys to terminate the EDR agent. A flaw in this driver (CVE-2024-51324) allows for arbitrary processes to be terminated.
In late July, CTU researchers analyzed an incident in which GOLD SALEM used the ToolShell exploit chain against SharePoint servers for initial access. This exploit chain relies on using a combination of vulnerabilities CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771.
CVE-2025-26399 (CVSS score: 9.8) - A deserialization of untrusted data vulnerability in the AjaxProxy component of SolarWinds Web Help Desk that could allow an attacker to run commands on the host machine. The addition of CVE-2025-26399 comes in the wake of reports from Microsoft and Huntress that threat actors are exploiting security flaws in SolarWinds Web Help Desk to obtain initial access. The activity is believed to be the work of the Warlock ransomware crew.
Groups observed using it
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
Groups including UAC-0238 exploited exposed RDP services to push ransomware variants such as X2anylock, Warlock, and LockBit 3.0 into compromised environments.
Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APT
GOLD SALEM (also known as Storm-2603) is a financially motivated cybercriminal threat group calling itself Warlock Group responsible for the distribution of the Warlock ransomware.
"WarLock ransomware hit Colt Telecom, causing outages in hosting, porting, Colt Online, and Voice API since August 12."
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
"That vulnerability, an authentication bypass that can be used to reset admin passwords..."
Remote Desktop Protocol remains one of the most abused entry vectors in 2025. Groups including UAC-0238 exploited exposed RDP services to push ransomware variants such as X2anylock, Warlock, and LockBit 3.0 into compromised environments.
Threat actors predominately exploited public-facing applications for initial access this quarter... Almost 40 percent of all engagements involved ToolShell activity... attackers began actively exploiting two path traversal vulnerabilities affecting on-premises SharePoint servers... resulting in unauthenticated remote code execution.
Persistence
2 techniques
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Impact
1 technique
Impact
IOCs tracked for this family
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
76 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family/group referenced as using a malicious msimg32.dll loader chain and vulnerable signed drivers in a BYOVD technique to terminate EDR components.
Ransomware variant used following RDP exploitation.
Ransomware deployed by Storm-2603 (Gold Salem) against multiple sectors in LAC and APAC.
Ransomware payload deployed after initial access to SmarterMail via exploited vulnerabilities; used in a campaign abusing legitimate administrative features and tools to gain control and maintain persistence before encryption.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.