🔴 Warlock Ransomware Hits Large Spanish, Portuguese Orgs

A Chinese ransomware outfit is exploiting Microsoft technologies to extort large and critical organizations in the Spanish- and Portuguese-speaking world.

The Warlock ransomware group — tracked by Symantec as "Longlegs" and by Microsoft as "Storm-2603" — has never fit neatly into any box. It surfaced in the summer of 2025, in a campaign that mirrored state-level espionage activity in its tactics, techniques, and procedures (TTPs). Yet it acted like a cybercrime gang, deploying ransomware against organizations without any apparent discrimination.