GOLD SALEM

GOLD SALEM (also known as Storm-2603) is a financially motivated cybercriminal threat group calling itself Warlock Group, which is responsible for the distribution of the Warlock ransomware. The group is likely to have begun intrusions with the intent to extort victims in March 2025. In June 2025, a persona associated with Warlock Group posted on the RAMP underground forum seeking exploits to common enterprise applications (such as Veeam, ESXi, and SharePoint) and for tools to kill security products like EDR. A subsequent post sought cooperation from initial access brokers (IAB) in providing potential victims but it is unclear if the group was seeking affiliates for a nascent ransomware-as-a-service (RaaS) scheme. Through August 2025, GOLD SALEM had published the names of 48 purported victims to the Warlock dedicated leak site (DLS). As of November 2025, this had risen to 73. In March 2026, the leak site remained active although no victim names had been listed for four months.
GOLD SALEM has been observed abusing the Microsoft SharePoint ToolShell exploit chain to gain initial access to victims before deploying the legitimate Velociraptor digital forensics and incident response tool. Persistence was originally achieved by emplacement of ASPX web shells but the group's tradecraft shifted to include GUI-based capability through TightVNC, according to Trend Micro. CTU researchers regularly saw the group use Cloudflared tunnels for command and control (C2), but the Yuze reverse proxy tool was also allegedly later used to establish a SOCKS5 connection with attacker-controlled infrastructure. GOLD SALEM has been observed using Mimikatz for credential harvesting, and PsExec and Impacket (WMI) for lateral movement within compromised environments. The group used Cloudlfare Workers domains to host its tooling for months before pivoting to Supabase. GOLD SALEM have used a variety of vulnerable drivers in attempts to disable endpoint detection and response (EDR) solutions.
CTU researchers have observed multiple encryptors used in Warlock ransomware intrusions. On Windows devices, GOLD SALEM has used a version of LockBit 3.0 (aka LockBit Black) and Warlock, which appends encrypted files with the .xlockxlock or .x2anylock extensions. To encrypt WMware ESXi servers, the group has used Babuk. Deployment of the ransomware payload is facilitated by Group Policy Object (GPO) with the executable frequently named after the intended victim.