walocker is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 1 public victims claimed by this operator between June 10, 2025. **walocker** is an obscure ransomware group that first emerged in June 2025, appearing to be financially motivated based on their operational profile. The group's country of origin and affiliations remain unknown due to limited public documentation, and it is unclear whether they operate as a Ransomware-as-a-Service model or as an independent entity. Their attack methodology, encryption techniques, and initial access vectors have not been publicly documented by major security firms or law enforcement agencies. The group has been observed targeting the financial services sector, specifically focusing on Cambodia (KH) as evidenced by their single documented victim in this region and sector. Given the recent emergence of walocker in June 2025 and the limited intelligence available, the group's current operational status remains active but with minimal publicly documented activity.

Recent disclosures by walocker

All 1 indexed disclosures. Click any row for the full per-victim dossier.

• SHUKAKU-INCFinancial Services · KH · June 10, 2025

See every disclosure indexed for walocker →