Back to Feed
RansomwareMar 17, 2026

Warlock Ransomware Group Augments Post-Exploitation Activities

The Warlock ransomware group has been observed employing a new Bring Your Own Vulnerable Driver (BYOVD) technique alongside other tools to conduct stealthier post-exploitation activities across compromised networks. This advancement demonstrates the group's evolving operational capabilities to evade detection and maintain persistence after initial compromise.

Summary

The Warlock ransomware group has been observed employing a new Bring Your Own Vulnerable Driver (BYOVD) technique alongside other tools to conduct stealthier post-exploitation activities across compromised networks. This advancement demonstrates the group's evolving operational capabilities to evade detection and maintain persistence after initial compromise.

Indicators of Compromise

  • malware — Warlock