Analysis of GOLD SALEM threat actor's tradecraft evolution over 6 months across 11 incidents deploying Warlock ransomware. The research examines the group's tactics, techniques, and procedures (TTPs) used in their ransomware operations. This represents an active ransomware campaign with documented incidents showing the threat actor's operational methods and deployment strategies for the Warlock ransomware family.