Loading malware…
HelloKitty is a ransomware family observed since late 2020 that encrypts victim data and demands payment for decryption. It targets Windows and Linux systems, with dedicated encryptors for VMware ESXi virtualization infrastructure. Implementations include C++ and Go variants. Windows variants use hybrid encryption combining per-file AES keys with an embedded RSA-2048 public key. The malware discovers network resources and searches for processes to terminate before encryption. Variants also stop services and delete volume shadow copies to interfere with recovery. ESXi encryptors attempt to shut down virtual machines using the esxcli management utility before encrypting their files. Encrypted-file extensions and ransom-note formats vary across variants and campaigns.
Vice Society used HelloKitty as a primary ransomware payload during its early operations in 2021, including campaigns against Linux systems. The group conducts human-operated double-extortion attacks and has disproportionately targeted education and healthcare organizations. Data theft, credential compromise, and lateral movement in those operations are associated with the attackers' broader intrusion workflows rather than established native HelloKitty capabilities. HelloKitty deployment has also been observed following exploitation of CVE-2023-46604, a remote code execution vulnerability in Apache ActiveMQ, including attacks against systems in South Korea. Operators use ransom notes and private communication channels to negotiate payment.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
At the start of the group’s observed operations in 2021, Vice Society affiliates used the HelloKitty Ransomware variant as a primary payload in their infection chain.
In July 2021 an encryptor that targeted explicitly VMware ESXi systems was discovered.
This activity group also developed and deployed the FiveHands and HelloKitty ransomware payloads and often gained access to an organization via DEV-0193’s BazaLoader infrastructure.
A threat actor has leaked the complete source code for the first version of the HelloKitty ransomware on a Russian-speaking hacking forum, claiming to be developing a new, more powerful encryptor.
HELLOKITTY ransomware—used to target Polish video game developer CD Projekt Red—is reportedly built from DEATHRANSOM.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Может распространяться путём взлома через незащищенную конфигурацию RDP
Может распространяться путём ... обманных загрузок, ... вредоносной рекламы, веб-инжектов, фальшивых обновлений
Может распространяться путём ... эксплойтов
Может распространяться путём ... с помощью email-спама и вредоносных вложений
Может распространяться путём ... с помощью email-спама и вредоносных вложений
When executed, HelloKitty terminates 1,706 processes, shuts down 57 services and deletes shadow copies via Windows Management Instrumentation.
Before starting the encryption, BlackCat shuts down the virtual machines with the esxcli command-line utility.
These actions are carried out via taskkill.exe and net.exe ... All spawned CMD windows are in the foreground and fully visible.
Red Canary detected an adversary executing discovery commands on dozens of cloud-based Linux endpoints vulnerable to a critical remote code vulnerability (CVE-2023-46604) in Apache ActiveMQ.
MITRE ATT&CK Data from Local System – T1005 ... Modify Registry – T1112
Может распространяться путём взлома через незащищенную конфигурацию RDP
“…load remote binaries with the names M2.png and M4.png… The 32-bit .NET executable named dllloader, contained in both MSI files…”
In these cases, the threat actors were able to delete cloud-stored backups prior to ransomware deployment.
MITRE ATT&CK ... File Deletion – T1070.004
“the attacker attempts to use the Windows Installer (msiexec) to load remote binaries with the names M2.png and M4.png after successful exploitation.”
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
MITRE ATT&CK Data from Local System – T1005 ... Modify Registry – T1112
MITRE ATT&CK ... Query Registry – T1012
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
"Babuk can enumerate disk volumes, get disk information"; "Ryuk has called GetLogicalDrives ... and GetDriveTypeW"; "Cuba can enumerate local drives, disk type, and disk free space"; "Chimera ... fsutil fsinfo drives"
APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
Может распространяться путём взлома через незащищенную конфигурацию RDP
"...multiple security flaws... impact SMA 200, 210, 400, 410, and 500v appliances even when the web application firewall (WAF) is enabled."
MITRE ATT&CK Data from Local System – T1005
Customization choices include legitimate certificates, non-standard CS ports, and malleable Command and Control (C2).
threat actors claimed to have stolen full copies of the source code for Cyberpunk 2077, The Witcher 3, Gwent and an unreleased version of The Witcher 3, along with documents relating to accounting, administration, legal, HR, investor relations and more.
Since then, it showed a steady activity, encrypting and exfiltrating its victim’s data and threatening their victims to leak their information to pressure them into paying a ransom.
The attackers threatened to sell or leak the stolen source code online and send the stolen documents to journalists in the gaming industry if CD Projekt refuses to cooperate.
Vice Society is known for its extortion tactics, encrypting devices and demanding a ransom.
When executed, HelloKitty terminates 1,706 processes, shuts down 57 services and deletes shadow copies via Windows Management Instrumentation.
When executed, HelloKitty terminates 1,706 processes, shuts down 57 services and deletes shadow copies via Windows Management Instrumentation.
For example, -w parameter can be used to stop all running virtual machines with the help of the esxcli command-line utility
The encrypted files and stolen data are then utilized as leverage in double-extortion machines, where the threat actors threaten to leak data if a ransom is not paid.
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.