Warlock

Warlock Ransomware Operation Targets Large Organizations in Spain and Portugal

Security researchers have identified the Warlock ransomware operation as conducting targeted attacks against large organizations in Spain and Portugal. The threat actor, attributed to China and active for approximately one year, exhibits a hybrid modus operandi combining characteristics of financially motivated cybercrime gangs with tactics, techniques, and procedures (TTPs) associated with state-associated advanced persistent threats (APTs). The attacks have caused significant disruption to targeted entities in Southern Europe, though specific details regarding initial access vectors, data exfiltration volume, and ransom demands remain limited in current reporting.