Khonsari

Khonsari is a ransomware family first publicly observed during the early wave of exploitation of the Apache Log4j Log4Shell vulnerability (CVE-2021-44228) in December 2021. It was delivered to vulnerable internet-facing Java applications through remote code execution enabled by Log4Shell, making it one of the earliest ransomware payloads associated with that mass-exploitation event. Reported attack chains involved retrieval of a malicious Java component that then downloaded and launched a .NET ransomware payload on compromised systems.

Khonsari is associated with file encryption and ransom-note deployment, and the family name was reflected in the encrypted-file extension and ransom messaging. At the same time, multiple analysts noted anomalies in the ransom note, including the apparent absence of credible attacker contact details, leading to assessments that some observed samples may have functioned more like destructive wipers than conventional profit-driven ransomware. Other reporting assessed that the malware used valid encryption, indicating genuine impact to victim data even if monetization and operator tradecraft appeared immature.

Khonsari has been discussed primarily in the context of opportunistic exploitation of unpatched Log4j-exposed systems rather than as a long-established ransomware operation with a well-documented affiliate ecosystem. It was one of several malware payloads rapidly deployed via Log4Shell alongside coin miners, botnets, remote access tools, and other ransomware families. Public reporting ties Khonsari to exploitation of vulnerable Java server applications, while the ransomware payload itself was a .NET binary affecting Windows environments.