Warlock Ransomware Hits Large Spanish, Portuguese Orgs

A Chinese threat actor, approximately a year old, is exhibiting characteristics of both a cybercrime gang and a state-associated advanced persistent threat. This actor has been targeting organizations in unexpected locations, including large entities in Spain and Portugal, using Warlock Ransomware. The group's behavior blends elements of financially motivated cybercrime with tactics commonly associated with state-sponsored actors. The Warlock Ransomware attacks have affected significant organizations in these regions. The threat actor's unusual blend of characteristics and targeting of unexpected locations sets it apart from other known actors. Its activities have raised interest due to this unique combination of traits and targets.