Chily

Chily is a ransomware threat actor or campaign name associated with a custom-branded Windows locker built from the same codebase used by Vice Society and SunnyDay. Analysis of the payloads indicates the Chily-branded ransomware shares an identical executable codebase with a Vice Society-branded variant, with differences confined primarily to campaign-specific configuration such as ransom note content, file extension, wallpaper text, and embedded keying material. This strongly suggests Chily used ransomware supplied by a shared external developer or developer group rather than being merely another alias for Vice Society. The underlying locker family uses a hybrid cryptographic design combining NTRUEncrypt for asymmetric protection of key material and ChaCha20-Poly1305 for per-file encryption. It supports multithreaded encryption for speed and can recursively encrypt files across local drives, remote drives, and network shares. The broader code lineage and builder-like design indicate a specialized ransomware development service capable of producing custom-branded payloads and corresponding decryptors for multiple customers. Available reporting does not support attributing Chily to a specific country or linking it to a distinct nation-state sponsor. The observed activity is consistent with financially motivated ransomware operations. High-confidence public details about Chily’s victimology, geographic targeting, and operational history remain limited beyond its use of this shared ransomware codebase.