Loading malware…
Warlock is a ransomware operation active since at least March 2025 and publicly advertising victims from June 2025. It is associated with the threat cluster Microsoft tracks as Storm-2603 and Sophos tracks as GOLD SALEM. Microsoft has assessed Storm-2603 with moderate confidence as China-based, although that attribution has not been independently confirmed by all researchers. Warlock has been observed targeting organizations across North America, Europe, South America, Latin America, and APAC, including government, healthcare, manufacturing, telecommunications, agriculture, energy, and other commercial sectors.
Warlock is notable for repeated exploitation of internet-facing on-premises Microsoft SharePoint servers, especially through the 2025 ToolShell exploit chain and later SharePoint deserialization vulnerabilities. Storm-2603 has been observed using SharePoint compromise for initial access, deploying web shells for persistence, stealing machine-key material, executing commands through IIS worker processes, creating administrative accounts, and then moving laterally before distributing ransomware. In compromised environments, operators have used Group Policy Objects to deploy the ransomware at scale.
Observed Warlock intrusions show a broad post-compromise toolkit and a mature intrusion lifecycle. Operators have used credential theft tooling including Mimikatz against LSASS, lateral movement utilities such as PsExec, Impacket, WMI, RDP, WinRM, and PowerShell remoting, and remote-management or tunneling tools including Zoho Assist, Visual Studio Code tunnels, Cloudflare tunneling, Velociraptor, and other legitimate administration software. Multiple incidents also show defense evasion through Bring Your Own Vulnerable Driver techniques to disable or tamper with endpoint protections, including use of signed vulnerable drivers and DLL sideloading chains. Data theft is a recurring component of operations, with exfiltration and leak-site extortion accompanying or preceding encryption.
Warlock has also been linked to exploitation of other enterprise-facing products beyond SharePoint, indicating an opportunistic focus on exposed services and known vulnerabilities for entry. The operation maintains a leak site and extortion workflow, and victim posting patterns indicate both encryption-based ransomware activity and data-theft-driven pressure tactics. Reporting has described Warlock as built on the leaked LockBit 3.0 builder, though its operational tradecraft reflects a distinct intrusion set centered on exploitation of public-facing enterprise infrastructure and aggressive post-exploitation activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
事例3:文書共有サーバ「SharePoint」(2025年/CVSS 9.8・CRITICAL) 社内の文書共有によく使われるMicrosoft SharePointのサーバが、2025年7月「ToolShell」と呼ばれる攻撃で広く悪用されました。 複数の攻撃グループがこの脆弱性を悪用し、そのうちの一つ(Microsoftが「Storm-2603」と呼ぶグループ)が、Warlockと呼ばれるランサムウェアを展開したと報告されています | そのうちの一つ(Microsoftが「Storm-2603」と呼ぶグループ)が、Warlockと呼ばれるランサムウェアを展開したと報告されています。
A high-severity bug in Microsoft SharePoint that’s been exploited since early July has been abused by ransomware, according to an Aug. 10 update to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog. CISA offered no more information on the nature of the ransomware attack, but the CVSS 8.8 flaw — CVE-2026-45659 — was added to the agency’s KEV on July 1 and patched by Microsoft in late May. | “They exploited the ToolShell zero-day chain in July 2025 to deploy Warlock ransomware, and now they're back doing the same thing with CVE-2026-45659,” said Calderone.
CISA said attackers were chaining together CVE-2025-49706 (6.5) and CVE-2025-49704 (8.8) to break into SharePoint Servers and, in some cases, deploy Warlock ransomware.
CISA said attackers were chaining together CVE-2025-49706 (6.5) and CVE-2025-49704 (8.8) to break into SharePoint Servers and, in some cases, deploy Warlock ransomware.
Microsoft later confirmed that Storm-2603, a threat actor known for deploying Warlock ransomware specifically through on-premises SharePoint bugs, was among the groups that piled on.
SmarterMail CVE-2026-23760 Storm-2603 (Warlock) ... observed during intrusions that lead to WarLock ransomware deployment or data exfiltration | This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
Gladinet CentreStack CVE-2025-14611 Storm-2603 (Warlock) ... observed during intrusions that lead to WarLock ransomware deployment or data exfiltration | This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
SolarWinds Web Help Desk CVE-2025-40551 Storm-2603 (Warlock) ... observed during intrusions that lead to WarLock ransomware deployment or data exfiltration | This is the list of vulnerabilities that have been observed during intrusions that lead to WarLock ransomware deployment or data exfiltration and leaks published to WarLock's Tor Site.
The version of Velociraptor observed in this incident was outdated (version 0.73.4.0) and exposed to a privilege escalation vulnerability (CVE-2025-6264), which may have been leveraged for persistence as this vulnerability can lead to arbitrary command execution and endpoint takeover.
CTU researchers also observed GOLD SALEM bypass EDR by using the Bring Your Own Vulnerable Driver (BYOVD) technique and a vulnerable Baidu Antivirus driver renamed googleApiUtil64.sys to terminate the EDR agent. A flaw in this driver (CVE-2024-51324) allows for arbitrary processes to be terminated.
CVE-2025-26399 (CVSS score: 9.8) - A deserialization of untrusted data vulnerability in the AjaxProxy component of SolarWinds Web Help Desk that could allow an attacker to run commands on the host machine. The addition of CVE-2025-26399 comes in the wake of reports from Microsoft and Huntress that threat actors are exploiting security flaws in SolarWinds Web Help Desk to obtain initial access. The activity is believed to be the work of the Warlock ransomware crew.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Groups including UAC-0238 exploited exposed RDP services to push ransomware variants such as X2anylock, Warlock, and LockBit 3.0 into compromised environments.
Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APT
GOLD SALEM (also known as Storm-2603) is a financially motivated cybercriminal threat group calling itself Warlock Group responsible for the distribution of the Warlock ransomware.
"WarLock ransomware hit Colt Telecom, causing outages in hosting, porting, Colt Online, and Voice API since August 12."
"Storm-2603 was using the exploit to deploy Warlock and another ransomware payload, LockBit."
7 distinct techniques documented for this family, organized by ATT&CK tactic.
"That vulnerability, an authentication bypass that can be used to reset admin passwords..."
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
84 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware reportedly deployed by Storm-2603 in SharePoint exploitation campaigns; described as being built on the leaked LockBit 3.0 builder.
Ransomware deployed by Storm-2603 following SharePoint exploitation.
Ransomware operators observed deploying Zoho Assist Unattended Agent to gain persistent, stealthy remote access without an active user session; activity was consistent with a successful Warlock ransomware attack observed in May.
Ransomware deployed in some SharePoint Server intrusions involving chained exploitation of ToolShell vulnerabilities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.