[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRaHwSXA17YAVU9Es1sWKn6E7POnVWWxykRvls-dY7Js":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"66596be8-8214-48c9-be77-f0d8212fccc8","Warlock Ransomware Hits Large Spanish, Portuguese Orgs","warlock-ransomware-hits-large-spanish-portuguese-orgs-cb1c29","A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected places.","A Chinese threat actor, known as Warlock, has been observed deploying ransomware against large organizations in Spain and Portugal. This actor exhibits characteristics of both cybercrime gangs and state-associated advanced persistent threats (APTs), making their motives and operational methods complex and unpredictable.","Warlock ransomware targets large Spanish and Portuguese organizations.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fwarlock-ransomware-spanish-portuguese","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt9bb24e8bd32cc751\u002F6abd41d4a6381712feda02db\u002FWarlock-Grandfailure-Getty.jpg?width=720&quality=80&disable=upscale","2026-10-01T13:00:00+00:00","2026-10-01T14:00:18.972435+00:00",7,[17],{"name":18,"type":19},"Warlock","threat_actor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":20,"icon":22,"name":23,"slug":24},null,"Ransomware","ransomware",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":41,"vendors":128},[42,70,99],{"slug":43,"name":44,"problem":45,"products":46},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","bitdefender-mdr","Bitdefender MDR","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fproducts\u002Fmanaged-detection-response-service","Managed detection and response, 24\u002F7.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":62},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","rapid7-mdr","Rapid7 MDR","https:\u002F\u002Fwww.rapid7.com\u002Fservices\u002Fmanaged-detection-and-response-mdr\u002F",{"slug":71,"name":72,"problem":73,"products":74},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"slug":100,"name":101,"problem":102,"products":103},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":147},"warlock-ransomware-targets-large-iberian-organizations-via-apt-linked-threat-actor","Warlock Ransomware Targets Large Iberian Organizations via APT-Linked Threat Actor","A Chinese threat actor dubbed Warlock is deploying ransomware against large organizations in Spain and Portugal, blending cybercriminal tactics with state-sponsored APT sophistication. This dual nature makes attribution difficult and defensive posturing more complex, as motivations may shift between financial gain and espionage. The targeting of large enterprises suggests the attackers are specifically seeking high-value ransoms or strategic data. Organizations must recognize that modern ransomware campaigns increasingly carry geopolitical dimensions, requiring defenses that go beyond traditional cybercrime playbooks.",[134,135,136,137,138,139,140,141,142,143,144,145,146],"CIS Control 10 – Malware Defenses","CIS Control 11 – Data Recovery","CIS Control 12 – Network Infrastructure Management","CIS Control 17 – Incident Response Management","NIST SP 800-53 IR-4 – Incident Handling","NIST SP 800-53 CP-9 – System Backup","NIST SP 800-53 SC-7 – Boundary Protection","NIST Cybersecurity Framework PR.AC-5 – Network Integrity","NIST Cybersecurity Framework DE.CM-1 – Network Monitoring","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","ITIL 4 – Major Incident Management Practice","ISO\u002FIEC 27001 A.16 – Information Security Incident Management",{"CIS Control 11 – Data Recovery":148,"CIS Control 10 – Malware Defenses":149,"NIST SP 800-53 CP-9 – System Backup":150,"NIST SP 800-53 IR-4 – Incident Handling":151,"GDPR Article 32 – Security of Processing":152,"NIST SP 800-53 SC-7 – Boundary Protection":153,"ITIL 4 – Major Incident Management Practice":154,"CIS Control 17 – Incident Response Management":155,"CIS Control 12 – Network Infrastructure Management":156,"GDPR Article 33 – Notification of a Personal Data Breach":157,"NIST Cybersecurity Framework PR.AC-5 – Network Integrity":158,"NIST Cybersecurity Framework DE.CM-1 – Network Monitoring":159,"ISO\u002FIEC 27001 A.16 – Information Security Incident Management":160},"Tested backups allow large organisations to recover without paying Warlock's ransom.","Malware defences can detect Warlock's tools and ransomware before encryption begins.","System backups enable recovery from Warlock's encryption.","Incident handling includes investigating whether data was stolen for espionage as well as encrypted.","Requires appropriate security of processing, including resilience against ransomware.","Boundary protection limits attackers' access and data exfiltration paths.","Major incident processes coordinate the response when ransomware disrupts large organisations.","A practised incident response plan helps organisations contain an attack that blends crime and espionage.","Network segmentation and hardening limit how far Warlock can spread once inside.","Requires notifying the authority when ransomware affects personal data.","Segmented networks reduce lateral movement before ransomware deployment.","Network monitoring can catch the lateral movement and staging that precede the encryption.","Incident management processes help organisations respond consistently to sophisticated ransomware attacks."]