warlock

· ActiveThe Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.

Victims

Status

Active

Sites

Countries Hit

Top Countries

US23

GB6

JP5

RU5

FR2

CA2

PL2

IN2

DK2

DE2

Top Sectors

Technology28

Manufacturing8

Public Sector5

Business Services5

Not Found4

Education3

Healthcare3

Construction3

Agriculture and Food Production3

Financial Services3

Recent Victims

View all 78 →

energogroup.net

RU · Energy

Nov 6, 2025

goldenline.com

PL · Technology

Nov 6, 2025

bengineered.com.au

AU · Technology

Nov 6, 2025

mnpease.ca

CA · Not Found

Nov 6, 2025

metro.local

US · Media and Entertainment

Nov 6, 2025

cybervector.co.uk

GB · Technology

Nov 6, 2025

fabrity.local

US · Not Found

Nov 6, 2025