The Warlock ransomware operation first emerged in June 2025, following an advertisement on a Russian cybercrime forum titled “if you want a Lamborghini, please call me,” and quickly evolved into a notable ransomware-as-a-service (RaaS) operation. The group operates via a closed, affiliate-style model, though public visibility into its internal structure is limited. Warlock activity has […]








