warlock_group
Warlock Group, also tracked by Microsoft as Storm-2603, is a Chinese-attributed ransomware operation. The group has used leaked LockBit Windows and Babuk VMware ESXi encryptors in attacks. According to the provided reporting, it launched in March 2025 using LockBit ransomware notes customized with a Tox ID for ransom negotiations, and in June 2025 rebranded itself as Warlock Group, after which it used customized ransom notes and operated dark web negotiation and data leak sites. Microsoft reported that the actors exploited a SharePoint vulnerability to breach corporate networks and deploy ransomware. Observed ransom demands ranged from $450,000 to several million dollars. The group was linked to the sale of allegedly stolen Colt Technology Services data on the Ramp cybercrime forum, where it claimed to have stolen 1 million documents and offered them for $200,000; the forum post was reportedly tied to Warlock through a matching Tox ID previously used in the group’s ransom notes. Known aliases directly mentioned in the content: Storm-2603.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Curtis did not share which vulnerability was exploited by the attackers, but CVE-2026-24423 seems like a likely candidate: the flaw was added to CISA’s Known Exploited Vulnerabilities catalog on February 5, 2026, and marked as “Exploited in ransomware attacks“.
It was disclosed alongside CVE-2026-23760, which is an authentication bypass vulnerability that can enable an unauthenticated attacker to force a password reset on a system administrator account. This enables full compromise of the SmarterMail instance.
Observables
8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.