Warlock ransomware
Named by 3 kept items in this workspace.
2 items name it under classification.key entities and 1 under threat actors.
Search every workspace for Warlock ransomware. It matches the name as written, so it can find other things that share it.
The items that name it 3
Ransomware operation that has used the legitimate Zoho Unattended Agent RMM tool to establish persistence and elevated access before deploying its encryptor.
All threat actors in this workspace.