Chinese-Linked Warlock Ransomware Targets Major Spanish and Portuguese Entities

A newly identified ransomware strain known as Warlock has begun encrypting data at large organizations in Spain and Portugal, marking the first public sightings of the malware in the Iberian Peninsula.

The group behind the attacks is believed to be a Chinese‑origin cyber operation that has been active for roughly a year. While its tactics and infrastructure resemble those of organized cybercrime syndicates, the level of sophistication and the choice of high‑profile targets also echo the behavior of state‑sponsored advanced persistent threat (APT) actors.

Victims span a range of sectors that were not traditionally associated with ransomware campaigns, including municipal administrations, educational institutions, and energy providers. Security analysts say the diversity of targets suggests the attackers are probing for weaknesses in sectors that have historically received less attention from ransomware gangs, potentially to expand their reach or to gather intelligence for future operations.

The emergence of Warlock in Europe adds a new dimension to an already volatile cyber‑threat landscape. Ransomware groups have increasingly leveraged “double‑extortion” tactics—threatening to publish stolen data unless a ransom is paid—raising the stakes for organizations that store sensitive personal or operational information. The involvement of a Chinese‑linked actor, whose motives appear to blend profit with geopolitical considerations, could complicate attribution and response efforts for both private firms and national authorities.

Local cybersecurity teams and law‑enforcement agencies have begun coordinated investigations, urging affected entities to isolate infected systems and to preserve forensic evidence. Experts recommend that organizations strengthen backup routines, apply patches promptly, and conduct regular phishing awareness training, as these measures remain the most effective line of defense against ransomware incursions. The incident serves as a reminder that even well‑resourced institutions are vulnerable to emerging threats that blur the lines between criminal enterprise and state‑backed cyber operations.