Warlock
Tracked by CyberSIXT since 24 Oct 2025
- Articlesall time
- 6
- Articleslast 30 days
- 4
- CVEs exploitedattributed · all time
- 7
- Research reportsall time
- 0
6 articles from 4 outlets since 24 Oct 2025; the latest 21 days ago.
- Article
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 5 Oct · 01:12 UTC | SecurityOnline | Longlegs Exploits SharePoint to Spread Warlock Ransomware at Scale |
| Sun 4 Oct · 08:35 UTC | Security Affairs | Warlock Ransomware Exploits SharePoint Flaws to Hit Critical Infrastructure |
| Sat 3 Oct · 15:46 UTC | The Hacker News | China-linked Warlock Exploits SharePoint to Deploy Ransomware Against Critical Sectors |
| Fri 2 Oct · 10:05 UTC | SecurityWeek | Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors |
| Sat 25 Jul · 12:00 UTC | The Hacker News | Cl0p exploits PTC Windchill flaw for unauthenticated RCE |
| Fri 24 Oct 2025 · 00:50 UTC | SecurityOnline | Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APT |
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
The Hacker News describes Warlock as China-linked and also known as Gold Salem, Longlegs and Storm-2603, with activity tracked by Symantec and Carbon Black Threat Hunter Team1. Symantec assessed that Warlock had been active against SharePoint since July 20252.
Symantec and Carbon Black Threat Hunter Team reported operations observed as recently as 22 July 2026, with victims including a water utility, a telecommunications provider, a regional government body and a university1. They reported web shells, theft of ASP.NET machine keys and use of the K7RKScan.sys driver (CVE-2025-1055) to disable security software before ransomware deployment1.
Sources
- China-linked Warlock Exploits SharePoint to Deploy Ransomware Against Critical Sectors · The Hacker News · 2026-10-03
- Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors · SecurityWeek · 2026-10-02
Diamond Model
What the record links to WarlockRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
- FIN11
- CyberSIXT coverage, Malpedia, MISP Galaxy
- DEV-0950
- Malpedia
- Lace Tempest
- Malpedia
- RAZOR COMET
- Malpedia, MISP Galaxy
- TA505
- Malpedia
- TEMP.Warlock
- Malpedia, MISP Galaxy
- UNC902
- Malpedia, MISP Galaxy
- Warlock
- CyberSIXT coverage
CVEs exploited
7 CVEs an article attributes to WarlockVendors targeted
MITRE ATT&CK® techniques
No MITRE ATT&CK® techniques are recorded for Warlock.
Also mentioned alongside Warlock (not attributed)1 CVE in the same articles
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to Warlock.
- Longlegs Exploits SharePoint to Spread Warlock Ransomware at ScaleSecurityOnline
- Warlock Ransomware Exploits SharePoint Flaws to Hit Critical InfrastructureSecurity Affairs
- China-linked Warlock Exploits SharePoint to Deploy Ransomware Against Critical SectorsThe Hacker News
- Warlock Ransomware Expands SharePoint Attacks Against Critical SectorsSecurityWeek
- Cl0p exploits PTC Windchill flaw for unauthenticated RCEThe Hacker News
- Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APTSecurityOnline · first in our coverage