Warlock, Gold Salem, Longlegs and Storm-2603 are one actor
Assessment
Four vendor names map to the same operation, but the equivalence rests on cross-vendor correlation at varying confidence, not a single established identity. Symantec tracks Longlegs (aka Storm-2603) and ties it to CL-CRI-1040, CamoFei and ChamelGang; Microsoft uses Storm-2603; Sophos/Secureworks CTU uses GOLD SALEM and notes the actor self-names Warlock Group. TechJuice's coverage even attributes all four aliases to Microsoft, which is wrong: Gold Salem is a Secureworks/Sophos designation. Readers repeating the bundle as a settled single identity overstate it.
Where this claim appeared
TechJuice · 2026-10-03
https://www.techjuice.pk/warlock-ransomware-exploits-sharepoint-flaws-critical-infrastructure/What “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
Warlock ransomware exploits SharePoint ToolShell flaws to hit water, telecom and government targetsThink this assessment is wrong? Report an error.