Warlock
Warlock is a ransomware family and associated ransomware operation active since at least March 2025, with public victim postings beginning in June 2025. It is linked to the threat group Warlock Group, which Sophos tracks as GOLD SALEM and Microsoft tracks as Storm-2603; Microsoft assessed Storm-2603 with moderate confidence as China-based, while Sophos said it lacked sufficient evidence to confirm that attribution. The operation has been described as a ransomware-as-a-service offering advertised on a Russian cybercrime forum, and it operates a Tor-based leak site for extortion and publication of stolen data. Reported victims span North America, Europe, South America, Latin America and the Caribbean, and Asia-Pacific, including sectors such as government, telecommunications, agriculture, energy and natural resources, and commercial enterprises.
Observed intrusion tradecraft includes exploitation of internet-facing on-premises Microsoft SharePoint vulnerabilities CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771. In these attacks, operators uploaded ASPX web shells including spinstall0.aspx and variants spinstall.aspx, spinstall1.aspx, and spinstall2.aspx; stole SharePoint ASP.NET MachineKeys; established persistence; dumped credentials with Mimikatz; moved laterally with PsExec, Impacket, and WMI; disabled Microsoft Defender via registry changes; and distributed Warlock ransomware through modified Group Policy Objects. Sophos also observed GOLD SALEM using ToolShell exploitation to deploy an ASPX web shell, downloading a Golang-based WebSockets backdoor as Sophos-UI.exe from filebin.net, and using a BYOVD technique with a vulnerable Baidu Antivirus driver renamed googleApiUtil64.sys, exploiting CVE-2024-51324, to terminate an EDR agent.
Warlock-linked activity also includes exploitation of SmarterMail vulnerabilities in 2026. Reporting states Storm-2603 exploited CVE-2026-23760, an authentication bypass allowing administrator password reset, and abused SmarterMail’s built-in Volume Mount feature to gain full system control; probing and exploitation of CVE-2026-24423, an unauthenticated RCE issue in ConnectToHub, were also reported. In these intrusions, the actor installed Velociraptor, including via an MSI payload named v4.msi hosted on Supabase, to maintain access and stage ransomware deployment. SmarterTools confirmed that the Warlock group breached its network on January 29, 2026 through an unpatched SmarterMail instance, affected about 12 Windows servers and a secondary QC data center, took over Active Directory after several days, created new users, deployed additional payloads including Velociraptor, and then attempted file encryption.
Additional reported behaviors include abuse of Velociraptor to establish a Visual Studio Code network tunnel to attacker-controlled infrastructure, use of legitimate remote administration or support tooling in some related intrusions, and deployment alongside or in proximity to other ransomware families including LockBit, Babuk, and X2anylock. Reported file-extension and note artifacts associated with Warlock activity include .xlockxlock and .x2anylock in some incidents. Published Warlock-related indicators include filenames such as IIS_Server_dll.dll, SharpHostInfo.x64.exe, xd.exe, debug_dev.js, and the path \1[5-6]\TEMPLATE\LAYOUTS\debug_dev.js; network indicators cited in reporting include 65.38.121.198, 131.226.2.6, 134.199.202.205, 104.238.159.149, 188.130.206.168, and c34718cbb4c6.ngrok-free.app.
High-confidence reporting also ties Warlock to notable incidents including attacks following SharePoint zero-day exploitation in July 2025 and the SmarterTools breach in January 2026. Public reporting states the group had reached dozens of leak-site victim listings in 2025, with one report citing 43 listings in Q3 2025 and another citing 60 victims by mid-September 2025.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The U.S. Cybersecurity and Infrastructure Security Agency warned earlier this month that remote code execution flaw - publicly known as "ToolShell" - allows unauthenticated system access and authenticated access via network spoofing. The agency said attackers can gain full access to SharePoint content, including file systems and configurations. | The computing giant published an emergency patch described by Google Cloud's Mandiant consulting chief technology officer as "uniquely urgent and drastic" (see: SharePoint Zero-Days Exploited to Unleash Warlock Ransomware).
CTU researchers also observed GOLD SALEM bypass EDR by using the Bring Your Own Vulnerable Driver (BYOVD) technique and a vulnerable Baidu Antivirus driver renamed googleApiUtil64.sys to terminate the EDR agent. A flaw in this driver (CVE-2024-51324) allows for arbitrary processes to be terminated. | CTU™ researchers track as GOLD SALEM, has compromised networks and deployed its Warlock ransomware since March 2025.
This exploit chain relies on using a combination of vulnerabilities CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771. | CTU™ researchers track as GOLD SALEM, has compromised networks and deployed its Warlock ransomware since March 2025.
This exploit chain relies on using a combination of vulnerabilities CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771. | CTU™ researchers track as GOLD SALEM, has compromised networks and deployed its Warlock ransomware since March 2025.
Microsoft Security Response Center (MSRC) published a blog addressing active attacks against on-premises SharePoint servers that exploit CVE-2025-49706, a spoofing vulnerability, and CVE-2025-49704, a remote code execution vulnerability. | Microsoft has observed another China-based threat actor, tracked as Storm-2603, exploiting these vulnerabilities to deploy ransomware... Starting on July 18, 2025, Microsoft has observed Storm-2603 deploying ransomware using these vulnerabilities... Storm-2603 is then observed modifying Group Policy Objects (GPO) to distribute Warlock ransomware in compromised environments.
CVE-2025-26399 (CVSS score: 9.8) - A deserialization of untrusted data vulnerability in the AjaxProxy component of SolarWinds Web Help Desk that could allow an attacker to run commands on the host machine. The addition of CVE-2025-26399 comes in the wake of reports from Microsoft and Huntress that threat actors are exploiting security flaws in SolarWinds Web Help Desk to obtain initial access. The activity is believed to be the work of the Warlock ransomware crew.
CVE‑2025‑6264 — Rapid7 Velociraptor Remote Code Execution... Exploitation Status: Actively exploited in ransomware campaigns.
SmarterTools confirmed last week that the Warlock ransomware gang breached its network after compromising an email system... In October 2025, Halcyon cybersecurity company linked the Warlcok ransomware gang to a Chinese nation-state actor tracked as Storm-2603.
SmarterTools confirmed last week that the Warlock ransomware gang breached its network after compromising an email system... In October 2025, Halcyon cybersecurity company linked the Warlcok ransomware gang to a Chinese nation-state actor tracked as Storm-2603.
SmarterTools confirmed last week that the Warlock (aka Storm-2603) ransomware gang breached its network by exploiting an unpatched SmarterMail instance.
Groups observed using it
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CTU™ researchers track as GOLD SALEM, has compromised networks and deployed its Warlock ransomware since March 2025.
Groups including UAC-0238 exploited exposed RDP services to push ransomware variants such as X2anylock, Warlock, and LockBit 3.0 into compromised environments.
Warlock Ransomware Hits US Firms Exploiting SharePoint Zero-Day, Linked to China’s CamoFei APT
GOLD SALEM (also known as Storm-2603) is a financially motivated cybercriminal threat group calling itself Warlock Group responsible for the distribution of the Warlock ransomware.
"WarLock ransomware hit Colt Telecom, causing outages in hosting, porting, Colt Online, and Voice API since August 12."
"Storm-2603 was using the exploit to deploy Warlock and another ransomware payload, LockBit."
"Storm-2603 was using the exploit to deploy Warlock and another ransomware payload, LockBit."
"Storm-2603 was using the exploit to deploy Warlock and another ransomware payload, LockBit."
"Storm-2603 was using the exploit to deploy Warlock and another ransomware payload, LockBit."
"Storm-2603 was using the exploit to deploy Warlock and another ransomware payload, LockBit."
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques"That vulnerability, an authentication bypass that can be used to reset admin passwords..."
Remote Desktop Protocol remains one of the most abused entry vectors in 2025. Groups including UAC-0238 exploited exposed RDP services to push ransomware variants such as X2anylock, Warlock, and LockBit 3.0 into compromised environments.
"SmarterTools... was hacked via a vulnerability in its own product... entry point was a virtual machine that was not updated... CVE-2026-24423... an authentication bypass that can be used to reset admin passwords..."
Persistence
2 techniques"That vulnerability, an authentication bypass that can be used to reset admin passwords..."
Privilege Escalation
1 techniqueStealth
1 techniqueImpact
1 techniqueSeveral intrusions led to the deployment of destructive wiper malware, ransomware, and long-running espionage tools designed to silently collect and exfiltrate sensitive information.
IOCs tracked for this family
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
71 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware variant used following RDP exploitation.
Ransomware deployed by Storm-2603 (Gold Salem) against multiple sectors in LAC and APAC.
Ransomware payload deployed after initial access to SmarterMail via exploited vulnerabilities; used in a campaign abusing legitimate administrative features and tools to gain control and maintain persistence before encryption.
Ransomware deployed following Storm-2603 exploitation of SmarterMail servers.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.