Warlock

Last Updated Nov 9, 2026

Also known as: Warlock

Warlock is an active extortion or ransomware group tracked by RansomLook.

📝 Last Updated Nov 9, 2026

Introduction

Warlock is an active extortion or ransomware group tracked by RansomLook.

Information pending cataloguing.

Information pending cataloguing.

Information pending cataloguing.

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Category	Observed tools
Credential Theft	Mimikatz, Veeam-Get-Creds
Defense Evasion	Antiy System In-Depth Analysis Toolkit driver (BYOVD), NsecSoft driver (BYOVD), Rising Antivirus driver (BYOVD), VMTools AV Killer (BYOVD)
Discovery	Everything.exe, SecurityCheck
Exfiltration	RClone
LOLBAS	Minidump, Msiexec, PowerShell Remoting (PSRemoting), PsExec, RDP Patcher
Networking	Azure Blog Storage, Catbox[.]moe, Cloudflared, MinIO, OpenSSH, Supabase, VS Code Tunnel, Yuze
OffSec	Cobalt Strike, Impacket, Velociraptor
RMM Tools	Radmin, TightVNC

Information pending cataloguing.

References pending cataloguing.

Structured source: RansomLook

Contains data derived from RansomLook, used under CC BY 4.0. Source: https://www.ransomlook.io/

License: CC BY 4.0

BushidoUK Ransomware Tool Matrix Tool observations were reviewed from the BushidoUK Ransomware Tool Matrix (https://github.com/BushidoUK/Ransomware-Tool-Matrix). The matrix is used here as a secondary ransomware tradecraft reference, not as sole attribution evidence. Repository Dataset
BushidoUK Ransomware Vulnerability Matrix Vulnerability observations were reviewed from the BushidoUK Ransomware Vulnerability Matrix (https://github.com/BushidoUK/Ransomware-Vulnerability-Matrix). The matrix is used here as a secondary ransomware exploitation reference, not as sole attribution evidence. Repository Dataset

High

161

Critical

Medium

Low