Description
WarLock is a ransomware operation that emerged in 2025 claiming victims through the exploitation of SharePoint servers. Its reported victims include the telecommunications company Colt, which the group offered for sale.
Stats
- First seen
- August 2025
- Last seen
- October 2026
Also known as
Warlock
Alert name variants
| Alert Name |
|---|
| Win32.Ransomware.Warlock |
| Win32.Ransomware.WarLock |
| Win64.Ransomware.Warlock |
| Win64.Ransomware.WarLock |