Warlock

As of Oct 19, 2026, Warlock has listed 68 confirmed victims on its leak site since Apr 10, 2025, 0.2% of all victims tracked by Brandefense. Its most targeted country is United States (29.4% of its victims) and its most targeted sector is Technology.

The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.