WhiteLock
WhiteLock is ransomware associated with Iranian-aligned cyber activity and tracked in reporting on operations linked to Cotton Sandstorm, also known as Haywire Kitten. Check Point Research reported that Cotton Sandstorm pre-positioned WezRat and WhiteLock before the February 28, 2026 strikes, and that intrusions involving the group used WezRat, a custom modular infostealer, followed in some cases by deployment of WhiteLock ransomware. Multiple cited reports state that WhiteLock was deployed specifically against Israeli targets, and that Cotton Sandstorm also used the Altoufan Team persona for hack-and-leak amplification. The available content does not provide technical details on WhiteLock’s encryption routine, persistence, propagation, ransom note format, or specific indicators of compromise beyond its observed association with Cotton Sandstorm/Haywire Kitten, prior WezRat deployment, and targeting of Israeli organizations in the context of the 2026 regional conflict.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cotton Sandstorm deployed WezRat and WhiteLock alongside the Altoufan persona for hack-and-leak amplification.
...attacks using ‘WhiteLock’ ransomware, deployed after WezRat infostealer.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor or access tool reportedly pre-positioned by Cotton Sandstorm before the February 28 strikes.
Malware deployed by Cotton Sandstorm alongside WezRat for hack-and-leak amplification.
Ransomware deployed following intrusions attributed to Cotton Sandstorm, reported as used specifically against Israeli targets in the described activity.
Ransomware used in Iran-aligned disruptive campaigns targeting Israel; noted as deployed after WezRat infostealer.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.