Warlock Ransomware Hits Large Spanish and Portuguese Organizations

· Cybersecurity · Spain · Portugal

A year-old Chinese threat actor known as Warlock is targeting large organizations in Spain and Portugal, exhibiting behavior that blends cybercrime and state-associated APT tactics. The group's unusual targeting broadens the ransomware threat landscape beyond typical English-speaking victims.

Why it matters：A threat actor that looks like a cybercrime gang but acts like an APT blurs the line between financially and politically motivated attacks, complicating attribution and defense strategies for European enterprises.

Key points

  • Warlock is described as a year-old Chinese threat actor.
  • It is hitting large Spanish and Portuguese organizations.
  • Its behavior mixes cybercrime gang and state-associated APT traits.

Sources (original reporting)

More stories from this day