Warlock Ransomware Targets Spanish, Portuguese Orgs; Chinese APT-Like Tactics

A threat actor dubbed Warlock, active for a year, has launched ransomware attacks against large organizations in Spain and Portugal. The actor exhibits characteristics of both cybercrime and state-associated APT behavior, deviating from typical ransomware targeting patterns. The attacks signal potential espionage or disruptive intent beyond financial gain, warranting heightened defensive posture in the region.