Tag: warlock

10 Attack Reports | 0 Vulnerabilities

Attack reports

Trial, Error, and Typos: Why Some Malware Attacks Aren't as 'Sophisticated' as You Think

This analysis challenges the notion that cyber threat actors are always sophisticated and organized. Through examining three incidents, it reveals that attackers often make mistakes, face obstacles, and adapt their tactics based on trial and error. The incidents showcase how threat actors struggled…

persistence techniques

malware deployment

shellcoderunner

Published: December 23, 2025

Downloadable IOCs: 10

GOLD SALEM tradecraft for deploying Warlock ransomware

This analysis examines the evolving tactics of the GOLD SALEM cybercrime group in deploying Warlock ransomware over a six-month period across 11 incidents. The group exploited SharePoint vulnerabilities for initial access and utilized tools like Velociraptor, VMTools AV killer, and Cloudflared for …

Published: December 11, 2025

Downloadable IOCs: 13

A Deep Dive Into Warlock Ransomware Deployed Via ToolShell SharePoint Chained Vulnerabilities

Warlock ransomware, exploiting SharePoint vulnerabilities CVE-2025-53770 and CVE-2025-53771, represents an advanced threat combining sophisticated encryption methods with targeted defense evasion techniques. The malware employs a multi-stage attack, terminating security services, removing recovery …

defense evasion

vulnerabilities

volume shadow copies

Published: October 30, 2025

Downloadable IOCs: 1

Warlock Ransomware: Old Actor, New Tricks?

The Warlock ransomware, first appearing in June 2025, is linked to a China-based actor with a history dating back to 2019. It gained prominence by exploiting the ToolShell vulnerability in Microsoft SharePoint. The group, known as Storm-2603, uses multiple ransomware payloads and a custom C&C frame…

Published: October 23, 2025

Downloadable IOCs: 0

ToolShell Used to Compromise Telecoms Company in Middle East

China-based attackers exploited the ToolShell vulnerability (CVE-2025-53770) to compromise a Middle Eastern telecoms company and government agencies in Africa and South America. The attackers deployed malware such as Zingdoor, ShadowPad, and KrustyLoader, which have been associated with Chinese thr…

Published: October 23, 2025

Downloadable IOCs: 0

Velociraptor leveraged in ransomware attacks

A ransomware attack involving the use of Velociraptor, an open-source digital forensics tool, has been linked to the threat actor Storm-2603. The attackers deployed Warlock, LockBit, and Babuk ransomware to encrypt virtual machines and servers. They exploited a vulnerability in an outdated version …

privilege-escalation

data-exfiltration

open-source-tools

Published: October 9, 2025

Linked vulnerabilities : CVE-2025-6264

Downloadable IOCs: 5

Warlock operation joins busy ransomware landscape

GOLD SALEM, also known as Warlock Group, has emerged as a significant player in the ransomware landscape since March 2025. The group has compromised networks across North America, Europe, and South America, targeting a range of organizations from small entities to large corporations. GOLD SALEM ope…

credential theft

lateral movement

dedicated leak site

sharepoint exploitation

Published: September 17, 2025

Linked vulnerabilities : CVE-2024-51324 (CVSS 3.8), CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 2

From SharePoint Vulnerability Exploit to Enterprise Ransomware

The Warlock ransomware group exploited unpatched Microsoft SharePoint servers to gain initial access and deploy ransomware across enterprise environments. The attack chain involved exploiting vulnerabilities, privilege escalation through Group Policy modification, credential theft using Mimikatz, l…

credential theft

dll sideloading

lateral movement

data exfiltration

Published: August 20, 2025

Downloadable IOCs: 0

Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks

Unit 42 has identified significant overlaps between Microsoft's reported ToolShell activity and a threat cluster they track as CL-CRI-1040. This cluster utilizes a tool set called Project AK47, which includes a multi-protocol backdoor, custom ransomware, and loaders. The activity is linked to the e…

ak47 ransomware

Published: August 6, 2025

Linked vulnerabilities : CVE-2024-1182 (CVSS 7.0), CVE-2024-7587 (CVSS 7.8), CVE-2024-8299 (CVSS 7.8), CVE-2025-0282 (CVSS 9.0), CVE-2025-0283 (CVSS 7.0), CVE-2024-53870 (CVSS 3.3), CVE-2025-31324 (CVSS 10.0), CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 27

Exploring Storm-2603's Previous Ransomware Operations

A focused analysis of Storm-2603, a threat actor linked to recent ToolShell exploitations alongside other Chinese APT groups, reveals their use of a custom malware C2 framework called 'ak47c2'. This framework includes HTTP and DNS-based clients. The group likely targeted organizations in Latin Amer…

Published: August 1, 2025

Linked vulnerabilities : CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 25

Click here to see more Attack Reports