The Rise of GOLD SALEM Ransomware Group

Recently, the cybersecurity world has been shaken by the emergence of a new ransomware group known as GOLD SALEM, also referred to as the Warlock Group. Active since March 2025, they have already targeted around 60 companies across North America, Europe, and South America. Their tool of choice? A custom-built Warlock ransomware, indicative of their sophisticated approach.

GOLD SALEM is tracked by Microsoft as Storm-2603 and is speculated to operate out of China, though no concrete evidence supports its exact origins. Unlike some ransomware operators, GOLD SALEM appears to purposefully avoid hitting entities within China and Russia. However, a recent attack on a Russian power generation company suggests their scope may be expanding.

This group made its underground debut in June 2025, clearly well-prepared with a strategy using a dual-extortion tactic. If companies refuse to pay, GOLD SALEM threatens to leak stolen data via a Tor-based site, showing their adeptness in psychological manipulation.

Advanced Evasion and Security Bypass Tactics

What makes GOLD SALEM stand out in a sea of ransomware groups is its ability to circumvent security solutions and maintain persistent network access. They exploit known vulnerabilities in widely used software like SharePoint, specifically targeting weaknesses cataloged as CVE-2025-49704 and others.

After successfully breaching a network, they employ an ASPX web shell combined with a Golang-based web server to maintain long-term access. This not only highlights their technical acumen but also their strategic foresight.

• Use a renamed driver from Baidu Antivirus to evade security measures.
• Deploy Mimikatz for credential theft and PsExec for spreading ransomware.
• Abuse Group Policy Objects to execute ransomware across networks seamlessly.

Their operations show a high degree of professionalism, from recruitment of access brokers to their slick data leak sites. This professional approach suggests that they may be gearing up to offer ransomware-as-a-service to other cybercriminals.

Stay informed and secure: Follow us on Google News, LinkedIn, and Twitter for the latest updates in cybersecurity and tips to protect your networks.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.