Warlock
The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.
Extension(s): .x2anylock
Victims
78
First Discovered
2025-06-11
victim
Last Discovered
2025-11-06
victim
Inactive Since
194
days
Avg Delay
27.1
days
Infostealer
27.7%
victims with domain
Countries
34
hit
Attack Velocity — Last 12 months
Known Locations (4)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Warlock Client Leaked Data Show | No | 2026-04-28T07:22:15 |
elqfbcx5nofwtqfookqml7ltx2g6q6tmddys6e25vgu3al2meim6cbqd.onion
|
|||
|
WarLock Client Data Leak Show | No | 2026-04-28T07:24:49 |
zfytizegsze6uiswodhbaalyy5rawaytv2nzyzdkt3susbewviqqh7yd.onion
|
|||
|
No | 2026-04-28T07:27:23 |
ocwjy4ynmpbbzhumh2ama2vl3bc77lf5auqf7nf4k45lbmzoep2rbyid.onion
|
||||
|
WarLock Client Data Leak Show | Yes | 2026-05-19T13:08:46 |
warlockhga5iw3t54ps5iytlilf7hlvxy7kwrkidspn4qoh64s4vsuyd.onion
|
Target
Top 5 Activity Sectors
- Technology 21
- Financial Services 4
- Manufacturing 3
- Construction 3
- Business Services 3
Top 5 Countries
-
United States
15
-
Russian Federation
5
-
United Kingdom
5
-
Japan
5
-
Poland
3
Heatmap
Ransom Notes (2)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
Everything.exe
SecurityCheck
|
Radmin
TightVNC
|
Antiy System In-Depth Analysis Toolkit driver (BYOVD)
NsecSoft driver (BYOVD)
Rising Antivirus driver (BYOVD)
VMTools AV Killer (BYOVD)
|
Mimikatz
Veeam-Get-Creds
|
Cobalt Strike
Velociraptor
|
Azure Blog Storage
Catbox[.]moe
Cloudflared
MinIO
OpenSSH
Supabase
VS Code Tunnel
Yuze
|
Minidump
Msiexec
PowerShell Remoting (PSRemoting)
PsExec
RDP Patcher
|
RClone
|
YARA Rules (1)
Indicators of Compromise (IoCs) (4)
Hash SHA256
1
tox
3
Victims (78)
165g data, including internal documents, financial documents, employee information, CRM database, HR…
This is only a part of the files and file list. The full set of files needs to be purchased separate…
[AI generated] BrightWork.com is a project management software company that provides solutions for t…
[AI generated] Via Optronics is a global technology company that specializes in the production of in…
[AI generated] Nippon India Mutual Fund (NIMF), previously known as Reliance Mutual Fund, is one of …
