Warlock

Warlock, also referred to as GOLD SALEM, is a ransomware threat group that emerged in 2025 and is notable for combining financially motivated extortion with aggressive exploitation of internet-facing enterprise software. Reporting has linked the group to exploitation activity involving Microsoft SharePoint in the ToolShell campaign and to additional edge-application compromises affecting products such as SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack. Multiple assessments characterize Warlock as a likely China-based operator, although public reporting does not establish a confirmed relationship to the older Warlock Dark Army name despite the similarity. Warlock operates as a double-extortion ransomware actor, encrypting victim systems while also stealing data for extortion leverage. Victim claims and incident reporting indicate targeting across a broad range of sectors, including government, aerospace, nuclear energy, telecommunications, manufacturing, and other enterprise environments. The group became visible quickly after first appearing in mid-2025 and was assessed as having posted dozens of victims within its first months of activity. A defining feature of Warlock tradecraft is heavy use of defense-evasion tooling, especially bring-your-own-vulnerable-driver techniques to disable endpoint protection. Warlock has been associated with repeated deployment of multiple EDR-killer tools within a single intrusion, sometimes using several alternatives redundantly until one succeeds. Public reporting ties the group to HexKiller, an EDR-killing utility previously considered exclusive to Warlock before later appearing in other actors’ intrusions, as well as to abuse of vulnerable drivers from several security and system software vendors. Researchers have also noted signs that at least one Warlock EDR-killer implementation may have been AI-assisted. Observed Warlock intrusions show a mature post-compromise toolkit spanning credential theft, remote administration, lateral movement, exfiltration, and living-off-the-land execution. Reported tooling includes common offensive frameworks and administrative utilities, cloud and tunneling services, remote management software, and credential-access tools. Warlock has also been noted for adapting legitimate software for malicious purposes, including early malicious use of Velociraptor and abuse patterns involving Visual Studio Code tunneling techniques. Warlock is associated with rapid exploitation of exposed edge infrastructure rather than reliance on traditional phishing-centric access. Reporting also notes overlap or proximity in some campaigns with activity tracked as Storm-2603, including incidents where multiple ransomware families or variants were deployed. While attribution details remain incomplete, the group is consistently described as a technically capable ransomware operator with a strong emphasis on zero-day or n-day exploitation of externally exposed systems, robust anti-EDR measures, and high-tempo enterprise intrusion operations.