Warlock Ransomware Deployed via Compromised GOLD SALEM Networks and Bypassed Security Solutions

Counter Threat Unit™ (CTU) researchers are tracking a sophisticated threat actor known as Warlock Group, which CTU designates as GOLD SALEM, and they have been active since March 2025, compromising enterprise networks and bypassing security solutions to deploy its custom Warlock ransomware.

According to the article, through mid-September 2025 GOLD SALEM published 60 victims on its dedicated leak site, placing it in the mid-range for ransomware operations by victim count this year, with targets spanning small firms, government bodies and multinationals across North America, Europe and South America.

The operation has begun to show geographic attribution disputes; Microsoft refers to the collective as Storm-2603 and associates it with moderate confidence to a China-based actor, but CTU researchers have not confirmed any geographic attribution. By September 16, 2025, the leak site had 19 victims (32%) with data published and 27 (45%) reportedly sold to private buyers, while a September 8 addition showed a Russia-based engineering services provider in the electricity generation sector on the list.

The group’s initial access and tradecraft included exploiting Microsoft SharePoint with the ToolShell chain, using CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771 to plant an ASPX web shell, and later bypassing EDR by renaming a vulnerable Baidu Antivirus driver (CVE-2024-51324) to googleApiUtil64.sys before credential harvesting, lateral movement and Warlock deployment via Group Policy Objects.

Mitigations call for aggressive patching, continuous attack surface monitoring and proactive endpoint and incident-response measures, with indicators such as various MD5, SHA1 and SHA256 hashes provided for ASPX web shells and the WebSockets tool.