Warlock
The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.
Threat level
MEDIUM
Get an alert if one of your domains is named on a ransomware leak site.
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
- Veeam-Get-Creds
DefenseEvasion
- Antiy System In-Depth Analysis Toolkit driver (BYOVD)
- NsecSoft driver (BYOVD)
- Rising Antivirus driver (BYOVD)
- VMTools AV Killer (BYOVD)
DiscoveryEnum
- Everything.exe
- SecurityCheck
Exfiltration
- RClone
LOLBAS
- Minidump
- Msiexec
- PowerShell Remoting (PSRemoting)
- PsExec
- RDP Patcher
Networking
- Azure Blog Storage
- Catbox[.]moe
- Cloudflared
- MinIO
- OpenSSH
- +3 more
Offsec
- Cobalt Strike
- Velociraptor
RMM-Tools
- Radmin
- TightVNC
Known infrastructure
The following Tor hidden services have been associated with this group:
ocwjy4ynmpbbzhumh2ama2vl3bc77lf5auqf7nf4k45lbmzoep2rbyid.onionWarlock Client Leaked Data ShowWarLock Client Data Leak ShowWarLock Client Data Leak Show
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Warlock’s victim list.
risk score · threat categories · sources · age · confidence — in one request