DETECTO/ThreatDossier
DashboardPricingThreatsRun Free ScanSign In
DETECTO/ThreatDossier

Security intelligence for MSPs, consultants, and businesses. Find breached credentials, compliance gaps, and exposed infrastructure before attackers do.

Product

  • Scan a Domain
  • Pricing
  • Dashboard
  • Sign In

Resources

  • Threat Intelligence
  • Ransomware Groups

Legal

  • Privacy Policy
  • Terms of Service

© 2026 DETECTO. All rights reserved.

Threats/Groups/Warlock

Warlock

Dormant

warlock

First seen: 2025-06-11 11:51:02.519396Total victims: 78

The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.

0Total Victims
0Countries Targeted
0Sectors Targeted
0Avg Attacks/Month

Activity Timelinelast 24 months

Top Targeted Sectors

Top Targeted Countries

Recent Victimsshowing 50 of 78

NameCountrySectorDate
energogroup.netRUEnergy2025-11-06 07:49:34.261620
goldenline.comPLTechnology2025-11-06 07:49:10.754767
bengineered.com.auAUTechnology2025-11-06 07:48:46.550591
mnpease.caCANot Found2025-11-06 07:48:21.048779
metro.local—Not Found2025-11-06 07:47:56.214823
cybervector.co.ukGBTechnology2025-11-06 07:47:31.415334
fabrity.local—Not Found2025-11-06 07:47:07.274825
miltech.local—Not Found2025-11-06 07:46:42.010616
mytune.me—Not Found2025-11-06 07:46:15.500903
atg.czCZTechnology2025-11-06 07:45:50.893444
tein.co.jpJPTechnology2025-11-06 07:45:46.784200
bel.quadra.ruRUNot Found2025-11-06 07:45:20.785280
ippm.org—Not Found2025-11-06 07:44:56.899690
sf.walltopia.comUSNot Found2025-11-06 07:44:22.355830
nartis.ruRUNot Found2025-11-06 07:43:57.489661
alphasys.boBONot Found2025-11-06 07:43:32.956802
silanosn.local—Not Found2025-11-06 07:43:07.894585
siball.netRUTechnology2025-09-23 16:26:16.597429
chroma.com.twTWTechnology2025-09-16 05:30:00.055212
ferus-smit.home—Not Found2025-09-16 05:29:36.114766
jubileelife.comPKFinancial Services2025-09-16 05:29:11.186812
kmssa.netSANot Found2025-09-16 05:28:47.449817
webville.net—Technology2025-09-16 05:28:23.769134
elssurveying.comUSNot Found2025-09-16 05:27:57.120925
medkar.comTRHealthcare2025-09-16 05:27:33.254237
okan.ruRUNot Found2025-09-08 17:45:32.363033
mffood.comDKAgriculture and Food Production2025-09-01 16:08:28.574881
gmpc.com—Not Found2025-09-01 16:08:04.031146
airfastindonesia.comIDTransportation/Logistics2025-08-25 16:58:04.704808
infoniqa.comATTechnology2025-08-18 17:46:17.646552
gmtaconlinePHNot Found2025-08-17 09:24:46.149359
woodboure—Not Found2025-08-17 09:24:42.467455
STRGOME—Not Found2025-08-17 09:24:37.355899
argeninta—Not Found2025-08-17 09:24:33.169183
houraFRNot Found2025-08-17 09:24:28.580760
houxtGBNot Found2025-08-17 09:24:24.965075
getdomainDKNot Found2025-08-17 09:24:21.278642
kiplINNot Found2025-08-17 09:24:18.435091
nszi—Not Found2025-08-17 09:24:15.446238
accsnet.comJPTechnology2025-08-17 09:24:10.672850
advion.comUSTechnology2025-08-17 09:23:46.852692
mysecop.com—Technology2025-08-17 09:23:23.155805
atcmanufacturing—Manufacturing2025-08-17 09:22:59.172917
orange.comFRTelecommunication2025-08-17 09:22:54.931859
anthembio.comUSHealthcare2025-08-17 09:22:51.077276
syspro.comUSTechnology2025-08-17 09:22:27.150157
brightwork.comUSTechnology2025-08-17 09:22:02.040254
starsalliance.com—Not Found2025-08-17 09:21:35.406838
sipecom.comECTechnology2025-08-17 09:21:11.726856
wytechnology.local—Not Found2025-08-17 09:20:47.877261

Data from ransomware.live