Skip to content
Auto-CTI
Back to all actors

Warlock

Unknown Dormant
Mentions
2
First seen
02 Oct 2026
Last seen
02 Oct 2026

Relevant to you · Relevant

Threat focus:
ransomware

Origin

Unattributed

Profile

Warlock is a threat actor using ransomware and exploiting SharePoint vulnerabilities. Recent reports show attacks on water and telecommunications operators. The actor is expanding SharePoint exploitation into critical infrastructure attacks.

Affected vendors

Microsoft

Targeted sectors

Critical InfrastructureWaterTelecommunications

Associated malware / tools

Warlock ransomware

Activity (8 weeks)

39
40
41
42
43
44
45
46

Recent activity

ESC

…