Warlock

☆ pin

Also known as Water Manaul, Storm-2603

Reports

First seen

Mar 16, 2026

Last seen

Jul 28, 2026

Motivation

Financial

Targeting

Sectors

Other ×1 Healthcare ×1

Top ATT&CK techniques

T1562.001 Impair Defenses: Disable or Modify Tools ×3T1486 Data Encrypted for Impact ×3T1567 Exfiltration Over Web Service ×2T1021.001 Remote Services: Remote Desktop Protocol ×2T1505.003 Server Software Component: Web Shell ×1T1218.011 System Binary Proxy Execution: Rundll32 ×1T1078 Valid Accounts ×1T1219 Remote Access Software ×1T1569.002 System Services: Service Execution ×1T1562.009 Impair Defenses: Safe Mode Boot ×1T1621 Multi-factor Authentication Request Generation ×1T1021 Remote Services ×1

Indicators

filename ×103domain ×1hash_sha1 ×1ip_v4 ×1url ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Warlock

Targeting

Top ATT&CK techniques

Indicators

Recent reports

IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

Ransomware as an industry: understanding the franchise operation behind modern extortion attacks

EDR Killers Explained: Beyond the Drivers — ESET's Analysis of 90 Active Tools

Warlock Ransomware: Enhanced Attack Chain with Web Shells, Tunnels, and BYOVD