Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE32 IOCs
China Linked Warlock Ransomware Campaign Targets Critical Infrastructure
Threat Actors
Malware Families
Diamond Model
Adversary(34)
Infrastructure
Capability(41)
Victim
Indicators of Compromise
Indicators of Compromise32
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2023-1389 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2025-49704 exploitintel-blogloader | High | 82 | Oct 9, 26 |
| CVE | CVE-2025-1055 exploitintel-blogloader | Medium | 56 | Jun 17, 26 |
| CVE | CVE-2022-30190 exploitintel-blogloader | High | 79 | Jun 12, 26 |
| SHA256 | 206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261 abuseacademic institutionsaccess | High | 82 | Aug 17, 25 |
| CVE | CVE-2025-0994 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| SHA256 | ae9f7fce57c7b928e659dccf0e00fa79cd9cd61a106f18d4e03f92dc3a03c295 abusealienvault_ransomwareapt27 | High | 68 | Oct 1, 26 |
| CVE | CVE-2022-47986 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2025-55182 aptbotnetc2 | High | 86 | Jun 2, 26 |
| CVE | CVE-2021-3493 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2023-34362 aptespionageexploit | High | 79 | Sep 3, 26 |
| CVE | CVE-2025-3248 botnetddosexploit | High | 79 | Jun 29, 26 |
| CVE | CVE-2025-53770 exploitintel-blogloader | High | 79 | Jun 12, 26 |
| CVE | CVE-2022-31199 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2021-21974 exploitintel-blogloader | High | 82 | Oct 9, 26 |
| CVE | CVE-2022-21894 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2025-49706 exploitintel-blogloader | High | 82 | Oct 9, 26 |
| CVE | CVE-2023-46604 exploitintel-blogloader | High | 79 | Aug 27, 26 |
| CVE | CVE-2021-4034 exploitintel-blogloader | High | 79 | Jun 2, 26 |
| CVE | CVE-2022-26134 exploitintel-blogloader | High | 83 | Oct 9, 26 |
| CVE | CVE-2023-2868 exploitintel-blogloader | High | 78 | Jun 2, 26 |
| CVE | CVE-2024-3400 aptespionageexploit | High | 79 | Jun 2, 26 |
| CVE | CVE-2023-22518 aptespionageexploit | High | 82 | Oct 9, 26 |
| CVE | CVE-2024-21412 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2021-33044 exploitintel-blogloader | High | 79 | Jul 30, 26 |
| CVE | CVE-2026-21509 aptespionageexploit | High | 79 | Jun 2, 26 |
| CVE | CVE-2017-7921 exploitintel-blogloader | High | 78 | Jun 3, 26 |
| CVE | CVE-2024-7344 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2023-36025 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2025-53771 exploitintel-blogloader | High | 82 | Oct 9, 26 |
| CVE | CVE-2024-40766 exploitintel-blogloader | High | 81 | Sep 9, 26 |
| CVE | CVE-2025-21042 exploitintel-blogloader | High | 81 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph32 total IOCs
CVESHA256