CVE Intelligence

warlock Ransomware

🔔 Criar alerta

Monitorado desde 10/06/2025

0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade

The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

Nenhuma CVE associada a este grupo nas fontes.

Ferramentas observadas

Credential Theft
Mimikatz · Veeam-Get-Creds
Defense Evasion
Antiy System In-Depth Analysis Toolkit driver (BYOVD) · NsecSoft driver (BYOVD) · Rising Antivirus driver (BYOVD) · VMTools AV Killer (BYOVD)
Discovery Enum
Everything.exe · SecurityCheck
Exfiltration
RClone
LOLBAS
Minidump · Msiexec · PowerShell Remoting (PSRemoting) · PsExec · RDP Patcher
Networking
Azure Blog Storage · Catbox[.]moe · Cloudflared · MinIO · OpenSSH · Supabase · VS Code Tunnel · Yuze
Offsec
Cobalt Strike · Velociraptor
RMM-Tools
Radmin · TightVNC

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live