Warlock
Tracked by CyberSIXT since 24 Oct 2025
- Articlesall time
- 6
- Articleslast 30 days
- 4
- CVEs exploitedattributed · all time
- 7
- Research reportsall time
- 0
9 articles from 4 outlets since 10 Oct 2025; the latest 21 days ago.
- Article
Show as table
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
The Hacker News describes Warlock as China-linked and also known as Gold Salem, Longlegs and Storm-2603, with activity tracked by Symantec and Carbon Black Threat Hunter Team1. Symantec assessed that Warlock had been active against SharePoint since July 20252.
Symantec and Carbon Black Threat Hunter Team reported operations observed as recently as 22 July 2026, with victims including a water utility, a telecommunications provider, a regional government body and a university1. They reported web shells, theft of ASP.NET machine keys and use of the K7RKScan.sys driver (CVE-2025-1055) to disable security software before ransomware deployment1.
Sources
- China-linked Warlock Exploits SharePoint to Deploy Ransomware Against Critical Sectors · The Hacker News · 2026-10-03
- Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors · SecurityWeek · 2026-10-02
Diamond Model
What the record links to WarlockRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
- FIN11
- CyberSIXT coverage, Malpedia, MISP Galaxy
- DEV-0950
- Malpedia
- Lace Tempest
- Malpedia
- RAZOR COMET
- Malpedia, MISP Galaxy
- TA505
- Malpedia
- TEMP.Warlock
- Malpedia, MISP Galaxy
- UNC902
- Malpedia, MISP Galaxy
- Warlock
- CyberSIXT coverage
CVEs exploited
7 CVEs an article attributes to WarlockVendors targeted
MITRE ATT&CK® techniques
No MITRE ATT&CK® techniques are recorded for Warlock.
Also mentioned alongside Warlock (not attributed)1 CVE in the same articles
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to Warlock.
- Longlegs Exploits SharePoint to Spread Warlock Ransomware at ScaleSecurityOnline
- New Malware Roundup Exposes AI Attacks and Evolving ThreatsSecurity Affairs
- Security Roundup Exposes CloudSyncD Mac Backdoor and AI Gateway FlawSecurity Affairs
- Warlock Ransomware Exploits SharePoint Flaws to Hit Critical InfrastructureSecurity Affairs
- China-linked Warlock Exploits SharePoint to Deploy Ransomware Against Critical SectorsThe Hacker News
- Warlock Ransomware Expands SharePoint Attacks Against Critical SectorsSecurityWeek
- Cl0p exploits PTC Windchill flaw for unauthenticated RCEThe Hacker News
- Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APTSecurityOnline
- DFIR Tool Hijacked: Ransomware Group Storm-2603 Abuses Velociraptor for Stealthy LockBit/Babuk AttacksSecurityOnline · first in our coverage