Warlock is a ransomware_group tracked across 10 threat clusters and 10 intelligence report mentions on ThreatCluster. First observed October 23, 2025; most recent activity June 15, 2026.
The Warlock ransomware group, also known as Water Manaul, has escalated its attack methods by exploiting unpatched Microsoft SharePoint servers and employing new tactics for persistence and lateral movement. Recent…
Qilin and Warlock ransomware variants have been identified exploiting vulnerable drivers to disable over 300 endpoint detection and response (EDR) tools. This exploitation allows the ransomware to evade detection and…
Recent research from ESET reveals that ransomware attackers are increasingly using EDR killers to disable endpoint detection and response (EDR) systems before launching their encryptors. These tools have become standard…
The 'Payroll Pirate' campaign has emerged, utilizing advanced phishing and AiTM session hijacking to bypass MFA and reroute payroll disbursements. Targeting mid-market and enterprise organizations, attackers exploit…
Eurofiber France has confirmed a significant data breach linked to a ransomware group, which has reportedly exposed sensitive corporate data now circulating on the darknet. The company is collaborating with…
Eurofiber France confirmed that cybercriminals accessed and stole data from its systems during a cyberattack on November 13, 2025. The breach targeted a vulnerability in the company's ticket management platform,…
Warlock ransomware has been deployed through vulnerabilities in ToolShell SharePoint. Organizations using affected SharePoint versions are at risk, as the ransomware exploits chained vulnerabilities to gain access.…
Warlock ransomware has been deployed using vulnerabilities in ToolShell SharePoint. The attack leverages chained vulnerabilities to gain access and encrypt data. Organizations using affected SharePoint systems are at…
ESET's Threat Report for H2 2025 reveals the emergence of AI-driven malware, specifically PromptLock, the first known AI-driven ransomware capable of generating malicious scripts in real-time. This development marks a…
Eurofiber France reported a data breach after hackers accessed its ticket management system on November 13, 2025, exploiting a software vulnerability. The breach affected the company's internal systems and involved the…