warlock
First seen June 10, 2025Active78 claimed victims
The claims below are reproduced as posted by warlock on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| silanosn.local | November 6, 2025 | ransomware_live | — |
| alphasys.bo | November 6, 2025 | ransomware_live | — |
| nartis.ru | November 6, 2025 | ransomware_live | — |
| sf.walltopia.com | November 6, 2025 | ransomware_live | — |
| ippm.org | November 6, 2025 | ransomware_live | — |
| bel.quadra.ru | November 6, 2025 | ransomware_live | — |
| tein.co.jp | November 6, 2025 | ransomware_live | — |
| atg.cz | November 6, 2025 | ransomware_live | — |
| mytune.me | November 1, 2025 | ransomware_live | — |
| miltech.local | November 1, 2025 | ransomware_live | — |
| fabrity.local | November 1, 2025 | ransomware_live | — |
| cybervector.co.uk | November 1, 2025 | ransomware_live | — |
| metro.local | November 1, 2025 | ransomware_live | — |
| mnpease.ca | November 1, 2025 | ransomware_live | — |
| bengineered.com.au | November 1, 2025 | ransomware_live | — |
| goldenline.com | November 1, 2025 | ransomware_live | — |
| energogroup.net | November 1, 2025 | ransomware_live | — |
| siball.net | September 23, 2025 | ransomware_live | — |
| medkar.com | September 16, 2025 | ransomware_live | — |
| elssurveying.com | September 16, 2025 | ransomware_live | — |
| webville.net | September 16, 2025 | ransomware_live | — |
| kmssa.net | September 16, 2025 | ransomware_live | — |
| jubileelife.com | September 16, 2025 | ransomware_live | — |
| ferus-smit.home | September 16, 2025 | ransomware_live | — |
| chroma.com.tw | September 16, 2025 | ransomware_live | — |
| okan.ru | September 8, 2025 | ransomware_live | — |
| gmpc.com | September 1, 2025 | ransomware_live | — |
| mffood.com | September 1, 2025 | ransomware_live | — |
| airfastindonesia.com | August 25, 2025 | ransomware_live | — |
| infoniqa.com | August 18, 2025 | ransomware_live | — |
| colt.net | August 17, 2025 | ransomware_live | — |
| clearybuilding.us | August 17, 2025 | ransomware_live | — |
| primrose.com | August 17, 2025 | ransomware_live | — |
| hitachi-hta.com | August 17, 2025 | ransomware_live | — |
| tagorg.com | August 17, 2025 | ransomware_live | — |
| wfd2027uae.ae | August 15, 2025 | ransomware_live | — |
| magcpa.com | August 14, 2025 | ransomware_live | — |
| brightwork.com | August 9, 2025 | ransomware_live | — |
| syspro.com | August 9, 2025 | ransomware_live | — |
| anthembio.com | August 9, 2025 | ransomware_live | — |
| orange.com | August 9, 2025 | ransomware_live | — |
| advion.com | August 9, 2025 | ransomware_live | — |
| accsnet.com | August 9, 2025 | ransomware_live | — |
| rougine-mfg.com | August 8, 2025 | ransomware_live | — |
| webcids.com | August 8, 2025 | ransomware_live | — |
| wytechnology.local | August 7, 2025 | ransomware_live | — |
| sipecom.com | August 6, 2025 | ransomware_live | — |
| starsalliance.com | August 6, 2025 | ransomware_live | — |
| mysecop.com | July 29, 2025 | ransomware_live | — |
| atcmanufacturing | July 16, 2025 | ransomware_live | — |
| getdomain | July 4, 2025 | ransomware_live | — |
| houxt | July 4, 2025 | ransomware_live | — |
| houra | July 4, 2025 | ransomware_live | — |
| argeninta | July 4, 2025 | ransomware_live | — |
| STRGOME | July 4, 2025 | ransomware_live | — |
| woodboure | July 4, 2025 | ransomware_live | — |
| gmtaconline | July 4, 2025 | ransomware_live | — |
| nszi | June 25, 2025 | ransomware_live | — |
| kipl | June 25, 2025 | ransomware_live | — |
| Arch-con | June 11, 2025 | ransomware_live | — |
| carducci | June 11, 2025 | ransomware_live | — |
| taos | June 11, 2025 | ransomware_live | — |
| icidesi | June 11, 2025 | ransomware_live | — |
| sras | June 11, 2025 | ransomware_live | — |
| astronika | June 11, 2025 | ransomware_live | — |
| dad | June 11, 2025 | ransomware_live | — |
| ssi-mi | June 11, 2025 | ransomware_live | — |
| lactanet | June 11, 2025 | ransomware_live | — |
| via-optronics | May 2, 2025 | ransomware_live | — |
| currimjee | May 2, 2025 | ransomware_live | — |
| nipponindiaim | April 30, 2025 | ransomware_live | — |
| KMMP | April 28, 2025 | ransomware_live | — |
| unilever | April 15, 2025 | ransomware_live | — |
| eira-group | April 10, 2025 | ransomware_live | — |
| iberol | April 10, 2025 | ransomware_live | — |
| NCVOO | April 4, 2025 | ransomware_live | — |
| Ersar | April 4, 2025 | ransomware_live | — |
| BTHK | April 2, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).