File · warlock · Crime · ransomware.live · refreshed 2026-10-06 · on the wire
warlock
sigil · no ATT&CK coverage stated
Last 30 days
last seen 13 d agoWhat changed
ledger · newest first- —15 d agoresurfacedback on the wire — nothing in the previous 30 days
Analyst brief
ransomware.liveThe Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates.
Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.
On the wire
1 dispatch · newest firstTake it with you
keyless · no signupReferences
1 sourceTrack warlock on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.