Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE29 IOCs

Warlock Ransomware Attackers Hit Water and Telecom Operators

Symantec

Published October 1, 2026Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(4)

Infrastructure(5)

Capability(9)

Victim

Indicators of Compromise

Indicators of Compromise29

Type	Indicator	Confidence	Score	First Seen
URL	https://litter.catbox.moe/6f5tdt.msi intel-blogmalwarenetwork	High	58	Oct 9, 26
CVE	CVE-2025-49704 exploitintel-blogloader	High	82	Oct 9, 26
CVE	CVE-2025-1055 exploitintel-blogmalware	Medium	53	Jun 17, 26
SHA256	73c5268256c9da5488cd9e2b79013060ac321c7e54129344dc7b51e268af36ea file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261 abuseacademic institutionsaccess	High	84	Aug 17, 25
SHA256	ae9f7fce57c7b928e659dccf0e00fa79cd9cd61a106f18d4e03f92dc3a03c295 abusealienvault_ransomwareapt27	High	63	Oct 1, 26
SHA256	aaff04d84ef85353966aa4af186ff1254b72c068f33f802417b29dc23fb9f192 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	c46825fcc0d1bf7a8b192facb176d6bf916c9dccfd6fa994be691e3b0e585f4e file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	8ce8d8270ee9de02644530b8dd7fa78973b4a3b80f121e2c5f45ae68cce196f9 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	8b58f7811a2a2f2a5024220490473774f02759dd2dd904b5b9fabfbaae37125f file-hashintel-blogmalware	Medium	53	Oct 9, 26
URL	https://xn8xyt-drop.s3.wasabisys.com/xn8xyt.msi intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	f7269f80f81e99d06a590d7ab374e12fdf7e5f55a02c2a46c342d670f8519fdf file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	37f94fe1b4a106f02b6f74a69cbc05e69c17406f688beef4c9a045ffcbd2e65e file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	e14240bac8277b0f6dd4d29ab5da20d246bcccae647e5fe8d19cdae7fe471b20 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	e3204b05e2f3a29bb6e6fcc21dda77d7cd31dfa755c21da0aa8661b5619ee0a1 file-hashintel-blogmalware	Medium	53	Oct 9, 26
CVE	CVE-2025-53770 exploitintel-blogloader	High	79	Jun 12, 26
Domain	oastify.com indicatorintel-blogmalware	Low	35	Feb 4, 23
SHA256	155fb1cbdaea12c83ba92d18c88cf38bbc42bb684f913ca0bc26fcf115426a55 abusealienvault_ransomwareapt27	Low	38	Oct 1, 26
SHA256	fb3846c9ac53d1b841ada3a6b1091153fea41a169cb44fe0084097d1f4d45984 abusealienvault_ransomwareapt27	Low	38	Oct 1, 26
CVE	CVE-2025-49706 exploitintel-blogloader	High	82	Oct 9, 26
SHA256	9ceb01f8bf7d6dba2ae07f5bd6070de3ec67b5eb01f969b0ba85e74564fb83a7 abusealienvault_ransomwareapt27	Low	38	Oct 1, 26
SHA256	6d07f1232dc59b84038fd0b2e75fdd3d5b825882bb0dba9e6724b7b0823fa3ad file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	27b7591cf9e1283010ca98fa5dbe970a73fee0d8cde277639924c144718db7c0 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	eea631b5f7125239db0811e4682c2316ead69f9822e02d94fb5d8bf0d2faebed file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	wasabisys.com exploitindicatorintel-blog	Low	27	Jul 31, 25
Domain	catbox.moe intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	1edb2c0b537cd95bbd5fc16321b4c38a6adf325ccc7b588ad6acc980b0463b60 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	116ca4e88a1bcebb6c0da7fb431c8eca7b8ef3f9767194820c56091972ccac2c abusealienvault_ransomwarebad reputation	Low	36	Oct 1, 26
CVE	CVE-2025-53771 exploitintel-blogloader	High	82	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph29 total IOCs

URLCVESHA256Domain

scroll to zoom · drag to pan · click IOC to open