Warlock is a ransomware group, also tracked as GOLD SALEM and Storm-2603. It is known for exploiting Microsoft SharePoint vulnerabilities, then encrypting files and stealing data to pressure victims into paying. CISA has reported Warlock ransomware on compromised SharePoint servers, and MITRE ATT&CK lists Storm-2603 as a China-based ransomware actor in the July 2025 ToolShell campaign. The post notes that attribution remains contested.
Introduction
By 2025, the ecosystem of ransomware had become as fragmented, competitive, and dangerous as it’s ever been. Among the many emerging groups that year was Warlock Group, aka GOLD SALEM and tracked by Microsoft as Storm-2603, which gained notoriety quickly. In just a few months of operations, Warlock was exploiting zero-day vulnerabilities in Microsoft SharePoint. It had implemented custom Command-and-Control (C2) frameworks. It had also developed a leak site featuring dozens of global victims.
The rise of Warlock Group exemplifies two more substantial trends in today’s cyber threat landscape. The first is the mixing of tradecraft from nation-state groups with that of financially-motivated ransomware. The second is the rapid weaponization of vulnerabilities in enterprise software.
Who is the Warlock group and what drives it?
Warlock Group is tracked under these multiple, related aliases:
- GOLD SALEM
- Storm-2603
- CL-CRI-1040
Attribution remains contested. Microsoft assesses with moderate confidence that the cluster is based in China. It bases this on operational overlap with clusters previously associated with Chinese-based threat activity. Other vendors shy away from any attribution, citing competition, opportunism, and similar factors. They stress that the group’s financial motivation (profit through ransomware extortion) could well weaken any state sponsorship angle.
Regardless of its origins, the group’s objectives are straightforward: profit from intrusions utilizing double extortion tactics. They will encrypt victim’s environments while stealing sensitive data, which they will publish on their leak site if the ransom is not paid.
- Also known as.
- GOLD SALEM, Storm-2603.
- Goal.
- Profit through double extortion ransomware.
- Initial access.
- Microsoft SharePoint “ToolShell” vulnerabilities.
- Custom C2.
- AK47, over HTTP and DNS.
- Leak site.
- Dark web site, previously known as Data Leak 101.
- Victims claimed.
- Just under 60 by mid-September 2025.
Tactics, Techniques, and Procedures (TTPs)
Initial Access: SharePoint “ToolShell” Exploitation
In July 2025, Warlock Group made headlines when it exploited a series of critical Microsoft SharePoint vulnerabilities collectively known as “ToolShell” (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771).
- These vulnerabilities enabled adversaries to achieve remote code execution capabilities on exploited SharePoint servers.
- Once the adversary was in the environment, they established persistence and a mechanism for lateral movement, deploying ASPX web shells (for example, spinstall0.aspx).
This uncritical exploitation exemplifies an increased trend of adversaries rushing to weaponize recently disclosed vulnerabilities with widely deployed enterprise software.
Persistence & Command-and-Control
Warlock was utilizing custom and off-the-shelf tools:
- AK47 C2 Framework: A custom tool that operates over both the HTTP and DNS protocols. It allows stealthy and covert command and control of compromised systems.
- Velociraptor & VS Code tunnels: These legitimate tools were abused for persistence and remote access.
The combination of custom tools and commoditized tools reveals the group’s adaptability and desire to make detection more complex.
Lateral Movement & Privilege Escalation
After establishing a foothold, Warlock used:
- Mimikatz to extract credentials from LSASS memory.
- PsExec and Impacket to move laterally across victim networks.
- BYOVD (Bring Your Own Vulnerable Driver) techniques to turn off endpoint detection and response (EDR) tools.
- Group Policy Objects (GPOs) to facilitate large-scale deployment of ransomware payloads.
This toolkit mirrors operations of established ransomware, demonstrating Warlock’s robust maturity.
- Exploit SharePointToolShell flaws give remote code execution
- Web shellASPX shell such as spinstall0.aspx keeps access
- Steal credentialsMimikatz reads LSASS memory
- Move sidewaysPsExec and Impacket spread across the network
- Disable defensesBYOVD techniques switch off EDR tools
- Deploy ransomwareGroup Policy Objects push the payload
- ExtortData is leaked if the ransom is not paid
Impact: Double Extortion Ransomware
Warlock’s operations end in the execution of its ransomware that encrypts victim systems and exfiltrates sensitive data at the same time. Victims are then publicly identified on the group’s dark web leak site, previously known as Data Leak 101. Pressure campaigns escalate if the ransom is not paid.
Who does the Warlock group target?
The Warlock group has exhibited broad target patterns that do not narrow in on a single sector. As of mid-September 2025, the group claimed just under 60 victims across diverse target sectors, to include:
- Manufacturing
- Telecommunications
- Technology
- Healthcare
- Construction
- Government agencies
Geographically, Warlock has not limited its operations to any of North America, Europe, and South America. It has also exhibited activity in the Asia-Pacific (APAC) and Latin American regions.
This targeting pattern is consistent with organized crime, financially motivated ransomware groups that are less concerned with target sector alignment and more concerned with opportunity.
Notable Operations
- April–May 2025 – Leak Site Launch
Warlock established its own dedicated leak site on the dark web shortly after launching attacks. This followed trends set by other ransomware groups. Its early victims were largely organizations in North America and Europe. - July 2025 – Initial Emergence
Warlock was first detected exploiting SharePoint ToolShell vulnerabilities, rapidly establishing itself as an emerging threat actor with capability. - August 2025 – SharePoint Zero-Day Exploits
While leveraging a new set of SharePoint zero-days, Warlock deployed ransomware during other high-profile breaches. This demonstrated agility by taking advantage of newly available exploits. - September 2025 – Expanding Operations
The group confirmed by September that it had multiplied its victim count to roughly 60 victims worldwide. This is evidence of Warlock’s establishment as one of the more active emerging ransomware groups.
How is the Warlock group evolving?
The evolution of Warlock Group is characterized by speed:
- Initially, the Warlock group began alongside LockBit 3.0 affiliates, but has more recently established itself as an independent operator.
- Recruitment efforts have been observed on underground forums where Warlock is seeking initial access brokers (IABs) and exploit developers to increase its operation.
- Warlock uses custom C2 (AK47) and employs advanced post-exploitation techniques. This shows an operational maturity that is not often seen in groups so new.
Looking ahead, a number of developments are anticipated:
- Continued Exploitation of Enterprise Software: Based on recent success within SharePoint, Warlock is expected to pivot quickly to other high-value software vulnerabilities.
- Victim Expansion: It is probable that the group will expand to critical infrastructure. This may increase ransom leverage as operational disruptions take hold.
- Possible State Nexus Debate: Because of operational similarities to other Chinese clusters, debate will persist on whether Warlock is a state-nexus hybrid actor or a financially motivated group.
Conclusion
The emergence of Warlock Group (GOLD SALEM / Storm-2603) in 2025 shows how quickly new players can appear in the ransomware economy and disrupt the cyber threat landscape. Warlock weaponized SharePoint vulnerabilities rapidly, used custom tooling like AK47 C2, and adopted aggressive double-extortion methods. Through these, it has quickly established itself as a high-risk potential actor with a global reach.
For defenders, key takeaways include:
- Prioritize patching of all Internet-facing applications, including SharePoint.
- Hardening Active Directory – especially against possible GPO and legitimate credential abuse.
- Reduce persistence indicators – especially unique ASPX files or DNS-based C2 activity.
- Plan for your double-extortion strategy so that you not only have backups in place, but also a strategy to respond when data is leaked.
The trajectory Warlock takes as it ramps up its operations will challenge enterprises’ resilience against a new wave of ransomware groups. It mixes state-like tradecraft with relentless financial pressure to meet its own goals.
You can download and review the sheet for all the details!
