THREAT ACTOR
WARLOCK_
DormantWARLOCK is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of WARLOCK, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 79
Leak site mirrors
10 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
elqfbcx5nofwtqfookqml7ltx2g6q6tmddys6e25vgu3al2meim6cbqd.onionWarlock Client Leaked Data Show snapshot · 2025-06-11 06:08 -
zfytizegsze6uiswodhbaalyy5rawaytv2nzyzdkt3susbewviqqh7yd.onionWarLock Client Data Leak Show snapshot · 2026-01-23 15:23 -
ocwjy4ynmpbbzhumh2ama2vl3bc77lf5auqf7nf4k45lbmzoep2rbyid.onionsnapshot · 2026-02-23 08:06 -
warlockoact3ayzqwlnay27b633bku2gmpq34dxb43v3qriujfea4yyd.onionWarLock Client Data Leak Show snapshot · 2026-07-09 12:16 -
warlock4fagqhnfuxtcmncfepe3jc33e33dmj2jsk64svxaerm5zhaqd.onionWarLock Client Data Leak Show snapshot · 2026-08-22 10:00 -
warlock5zli2g4nuvixkgyivpda4ktg6flx5lbtw3u6g5lidgxzjc6id.onionWarLock Client Data Leak Show snapshot · 2026-08-22 10:02 -
warlock6d4etw5gwwaakh6auh6cwkinhk2bx7bbldu4m5axlcwmbuuyd.onionWarLock Client Data Leak Show snapshot · 2026-08-22 10:02 -
warlockhga5iw3t54ps5iytlilf7hlvxy7kwrkidspn4qoh64s4vsuyd.onionWarLock Client Data Leak Show snapshot · 2026-08-22 10:11 -
warlockmdu64clit5pdwbp5hsd576vcjjigfwbtz5gtthmuy2fiqblad.onionWarLock Client Data Leak Show snapshot · 2026-07-09 12:15 -
warlockoact3ayzqwlnay27b633bku2gmpq34dxb43v3qriujfea4yyd.onionWarLock Client Data Leak Show snapshot · 2026-07-09 12:01
Recent victims
The 50 most recent victims claimed by WARLOCK. Total in the index: 79.
| Date listed | Victim | Description |
|---|---|---|
| 2025-12-26 | energogroup.net | No description provided. |
| 2025-12-26 | goldenline.com | No description provided. |
| 2025-12-26 | silanosn.local | No description provided. |
| 2025-12-26 | bengineered.com.au | No description provided. |
| 2025-12-26 | mnpease.ca | No description provided. |
| 2025-12-26 | metro.local | No description provided. |
| 2025-12-26 | cybervector.co.uk | No description provided. |
| 2025-12-26 | fabrity.local | No description provided. |
| 2025-12-26 | miltech.local | No description provided. |
| 2025-12-26 | mytune.me | No description provided. |
| 2025-12-26 | alphasys.bo | No description provided. |
| 2025-12-26 | nartis.ru | No description provided. |
| 2025-12-26 | sf.walltopia.com | No description provided. |
| 2025-12-26 | ippm.org | No description provided. |
| 2025-12-26 | bel.quadra.ru | No description provided. |
| 2025-12-26 | tein.co.jp | No description provided. |
| 2025-12-26 | atg.cz | No description provided. |
| 2025-09-23 | siball.net | all data |
| 2025-09-16 | chroma.com.tw | all data |
| 2025-09-16 | ferus-smit.home | all data |
| 2025-09-16 | jubileelife.com | all data |
| 2025-09-16 | kmssa.net | all data |
| 2025-09-16 | webville.net | all data |
| 2025-09-16 | elssurveying.com | all data |
| 2025-09-16 | medkar.com | all data |
| 2025-09-08 | okan.ru | finance data |
| 2025-09-01 | mffood.com | 300G data |
| 2025-09-01 | gmpc.com | No description provided. |
| 2025-08-25 | airfastindonesia.com | all user data |
| 2025-08-18 | infoniqa.com | 165g data, including internal documents, financial documents, employee… |
| 2025-08-16 | hitachi-hta.com | all data |
| 2025-08-16 | accsnet.com | all data |
| 2025-08-16 | advion.com | all data |
| 2025-08-16 | mysecop.com | all data |
| 2025-08-16 | atcmanufacturing | all data |
| 2025-08-16 | orange.com | all data |
| 2025-08-16 | anthembio.com | all data |
| 2025-08-16 | syspro.com | all data |
| 2025-08-16 | brightwork.com | No description provided |
| 2025-08-16 | starsalliance.com | The data has been purchased by other buyers |
| 2025-08-16 | sipecom.com | all data |
| 2025-08-16 | wytechnology.local | The data has been purchased by other buyers |
| 2025-08-16 | webcids.com | all data |
| 2025-08-16 | rougine-mfg.com | all data |
| 2025-08-16 | magcpa.com | all data |
| 2025-08-16 | wfd2027uae.ae | all data |
| 2025-08-16 | clearybuilding.us | all data |
| 2025-08-16 | colt.net | 1 million documents |
| 2025-08-16 | primrose.com | all data |
| 2025-08-16 | hitachi.hta.com | all data |
CONFIRMED ATTACKS
Warlock confirmed attacks: 13 verified incidents
Ransomnews has verified 13 Warlock incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2025 to January 2026. United States accounts for 2 of them (15%), with victims recorded in 12 countries in total. The most affected sector is government, at 3 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 12. Where a figure was disclosed (2 cases), these incidents account for 9,179 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Warlock incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| January 2026 | SmarterTools Inc. | Technology | Arizona, United States | — | Unknown | Source |
| October 2025 | WALLTOPIA | Manufacturing | Sofia, Bulgaria | — | No | Source |
| October 2025 | TEIN, Inc. | Manufacturing | Yokohama, Japan | 7,304 | Unknown | Source |
| September 2025 | SSA Holdings, LLC (SSA Group) | Service | Colorado, United States | 1,875 | Unknown | Source |
| September 2025 | Chroma ATE Inc. | Manufacturing | Taoyuan City, Taiwan | — | Unknown | Source |
| September 2025 | Jubilee Life Insurance Company Ltd. | Finance | Karachi, Pakistan | — | Unknown | Source |
| August 2025 | Infoniqa | Technology | Wels, Austria | — | Unknown | Source |
| August 2025 | Colt Technology Services Group Limited | Utilities | London, United Kingdom | — | Unknown | Source |
| July 2025 | Orange | Utilities | Issy-les-Moulineaux, France | — | Unknown | Source |
| April 2025 | Nippon Life India Asset Management Ltd | Finance | Mumbai, India | — | Unknown | Source |
| March 2025 | Bilgi Teknolojileri ve Haberleşme Kurumu (Information Technologies and Communication Authority) | Government | Metehan, Turkey | — | Unknown | Source |
| March 2025 | Nacionalni centar za vanjsko vrednovanje obrazovanja (NCVVO) | Government | Zagreb, Croatia | — | Unknown | Source |
| March 2025 | Entidade Reguladora dos Serviços de Água e Resíduos (ERSAR) | Government | Lisbon, Portugal | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Warlock's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.