warlock

Key insights

• •Warlock leverages unpatched Microsoft SharePoint vulnerabilities for initial access, particularly exploiting the ToolShell vulnerability chain.
• •The group uses its proprietary ransomware with a distinctive .x2anylock file extension, often combined with data exfiltration efforts.
• •Warlock employs a double extortion strategy, threatening to leak stolen data publicly alongside file encryption.
• •The group utilizes advanced tactics for evasion, such as deploying vulnerable third-party drivers and executing custom malware.
• •Ties to Storm-2603 and possible connection with the Black Basta group suggest a broad network of cybercriminal activity.
• •Warlock targets a range of sectors including healthcare, finance, and public administration with significant impacts on these industries.