// THREAT ACTOR
WARLOCK_
ActiveWARLOCK is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of WARLOCK — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
79
Victims tracked
4 / 10
Active mirrors
2025-06-10
First listing
2025-12-26
Most recent
Victims by year
- 2025 79
Leak site mirrors
10 mirrors tracked, 4 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
elqfbcx5nofwtqfookqml7ltx2g6q6tmddys6e25vgu3al2meim6cbqd.onionWarlock Client Leaked Data Show snapshot · 2025-06-11 06:08 -
zfytizegsze6uiswodhbaalyy5rawaytv2nzyzdkt3susbewviqqh7yd.onionWarLock Client Data Leak Show snapshot · 2026-01-23 15:23 -
ocwjy4ynmpbbzhumh2ama2vl3bc77lf5auqf7nf4k45lbmzoep2rbyid.onionsnapshot · 2026-02-23 08:06 -
warlockoact3ayzqwlnay27b633bku2gmpq34dxb43v3qriujfea4yyd.onionWarLock Client Data Leak Show snapshot · 2026-07-09 12:16 -
warlock4fagqhnfuxtcmncfepe3jc33e33dmj2jsk64svxaerm5zhaqd.onionWarLock Client Data Leak Show snapshot · 2026-08-06 21:40 -
warlock5zli2g4nuvixkgyivpda4ktg6flx5lbtw3u6g5lidgxzjc6id.onionWarLock Client Data Leak Show snapshot · 2026-08-06 21:16 -
warlock6d4etw5gwwaakh6auh6cwkinhk2bx7bbldu4m5axlcwmbuuyd.onionWarLock Client Data Leak Show snapshot · 2026-08-06 21:00 -
warlockhga5iw3t54ps5iytlilf7hlvxy7kwrkidspn4qoh64s4vsuyd.onionWarLock Client Data Leak Show snapshot · 2026-08-06 21:17 -
warlockmdu64clit5pdwbp5hsd576vcjjigfwbtz5gtthmuy2fiqblad.onionWarLock Client Data Leak Show snapshot · 2026-07-09 12:15 -
warlockoact3ayzqwlnay27b633bku2gmpq34dxb43v3qriujfea4yyd.onionWarLock Client Data Leak Show snapshot · 2026-07-09 12:01
Recent victims
The 50 most recent victims claimed by WARLOCK. Total in the index: 79.
| Date listed | Victim | Description |
|---|---|---|
| 2025-12-26 | energogroup.net | No description provided. |
| 2025-12-26 | goldenline.com | No description provided. |
| 2025-12-26 | silanosn.local | No description provided. |
| 2025-12-26 | bengineered.com.au | No description provided. |
| 2025-12-26 | mnpease.ca | No description provided. |
| 2025-12-26 | metro.local | No description provided. |
| 2025-12-26 | cybervector.co.uk | No description provided. |
| 2025-12-26 | fabrity.local | No description provided. |
| 2025-12-26 | miltech.local | No description provided. |
| 2025-12-26 | mytune.me | No description provided. |
| 2025-12-26 | alphasys.bo | No description provided. |
| 2025-12-26 | nartis.ru | No description provided. |
| 2025-12-26 | sf.walltopia.com | No description provided. |
| 2025-12-26 | ippm.org | No description provided. |
| 2025-12-26 | bel.quadra.ru | No description provided. |
| 2025-12-26 | tein.co.jp | No description provided. |
| 2025-12-26 | atg.cz | No description provided. |
| 2025-09-23 | siball.net | all data |
| 2025-09-16 | chroma.com.tw | all data |
| 2025-09-16 | ferus-smit.home | all data |
| 2025-09-16 | jubileelife.com | all data |
| 2025-09-16 | kmssa.net | all data |
| 2025-09-16 | webville.net | all data |
| 2025-09-16 | elssurveying.com | all data |
| 2025-09-16 | medkar.com | all data |
| 2025-09-08 | okan.ru | finance data |
| 2025-09-01 | mffood.com | 300G data |
| 2025-09-01 | gmpc.com | No description provided. |
| 2025-08-25 | airfastindonesia.com | all user data |
| 2025-08-18 | infoniqa.com | 165g data, including internal documents, financial documents, employee… |
| 2025-08-16 | hitachi-hta.com | all data |
| 2025-08-16 | accsnet.com | all data |
| 2025-08-16 | advion.com | all data |
| 2025-08-16 | mysecop.com | all data |
| 2025-08-16 | atcmanufacturing | all data |
| 2025-08-16 | orange.com | all data |
| 2025-08-16 | anthembio.com | all data |
| 2025-08-16 | syspro.com | all data |
| 2025-08-16 | brightwork.com | No description provided |
| 2025-08-16 | starsalliance.com | The data has been purchased by other buyers |
| 2025-08-16 | sipecom.com | all data |
| 2025-08-16 | wytechnology.local | The data has been purchased by other buyers |
| 2025-08-16 | webcids.com | all data |
| 2025-08-16 | rougine-mfg.com | all data |
| 2025-08-16 | magcpa.com | all data |
| 2025-08-16 | wfd2027uae.ae | all data |
| 2025-08-16 | clearybuilding.us | all data |
| 2025-08-16 | colt.net | 1 million documents |
| 2025-08-16 | primrose.com | all data |
| 2025-08-16 | hitachi.hta.com | all data |