The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.
How is the Warlock ransomware group related to Black Basta and LockBit?+
Warlock is a likely China-based cybercriminal group attributed to Storm-2603. They operated as a former affiliate of both LockBit and Black Basta RaaS operations before creating their own custom ransomware encryptor and launching independent operations.
What are the main tactics and targets of the Warlock group?+
Warlock primarily conducts financially motivated attacks targeting corporate networks. They use their own custom ransomware encryptor, leverage RaaS ecosystems, and potentially reuse tools from LockBit/Black Basta operations.