R
Ransomwhere.org
Live MapLatest VictimsGroups
PaymentsTTPsIdentifyNewsDataAPI
LIVE
Ransomwhere.org

Real-time ransomware intelligence platform. Tracking threat actors, victims, and payments to raise awareness and help defend against ransomware attacks worldwide.

Platform

  • Live Map
  • Latest Victims
  • Groups
  • Payments
  • Identify
  • News

Resources

  • Data & Methodology
  • API Docs
  • NoMoreRansom
  • Ransomware.live
  • CISA Advisories

Data sourced from Ransomware.live API. For informational purposes only.

© 2026 Ransomwhere.org

Groups/warlock

warlock

Active

The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.

78
Victims
4
Sites

Known Leak Sites

elqfbcx5nofwtqfookqml7ltx2g6q6tmddys6e25vgu3al2meim6cbqd.onionDLS
zfytizegsze6uiswodhbaalyy5rawaytv2nzyzdkt3susbewviqqh7yd.onionDLS
ocwjy4ynmpbbzhumh2ama2vl3bc77lf5auqf7nf4k45lbmzoep2rbyid.onionFiles
warlockhga5iw3t54ps5iytlilf7hlvxy7kwrkidspn4qoh64s4vsuyd.onionDLS

Victims (78)

Live
energogroup.net
warlockRU
goldenline.com
warlockPL
bengineered.com.au
warlockAU
mnpease.ca
warlockCA
metro.local
warlock
cybervector.co.uk
warlockGB
fabrity.local
warlock
miltech.local
warlock
mytune.me
warlock
atg.cz
warlockCZ
tein.co.jp
warlockJP
bel.quadra.ru
warlockRU
ippm.org
warlock
sf.walltopia.com
warlockUS
nartis.ru
warlockRU
alphasys.bo
warlockBO
silanosn.local
warlock
siball.net
warlockRU
chroma.com.tw
warlockTW
ferus-smit.home
warlock
jubileelife.com
warlockPK
kmssa.net
warlockSA
webville.net
warlock
elssurveying.com
warlockUS
medkar.com
warlockTR

Top Targeted Countries

Unknown21
United States12
Japan5
RU5
United Kingdom4

Activity

Total victims78
Countries affected30
Last seen