Loading story…
CyberVolk, a pro-Russian hacktivist group, has resurfaced after a period of inactivity with a new ransomware-as-a-service (RaaS) platform called VolkLocker (CyberVolk 2.x). The operation is notable for its use of Telegram to automate payload generation, affiliate management, and attack coordination, making it accessible to less technically skilled actors. Unlike other pro-Russian hacktivist groups that focus on DDoS attacks, CyberVolk has expanded its tactics to include ransomware, targeting both Linux and Windows systems with payloads written in Golang.
Despite the increased automation and ease of use, VolkLocker suffers from significant security flaws. The ransomware's master decryption keys are hardcoded into the executable files, allowing victims to potentially recover their data without paying a ransom. The platform also lacks advanced obfuscation, relying on UPX packing rather than native crypting features, and includes test artifacts that further undermine its effectiveness. These operational missteps highlight the group's growing pains as it attempts to scale its RaaS offering, even as it remains active and potentially dangerous to organizations targeted by its affiliates.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Following the technical disclosure, SentinelOne published indicators of compromise and noted that its Singularity Endpoint Platform detects and prevents CyberVolk ransomware attacks. Reporting also highlighted defensive recommendations such as monitoring privilege-escalation activity and suspicious registry access tied to the malware's UAC bypass behavior.
SentinelOne researchers revealed that VolkLocker stores its master encryption key in plaintext on victim systems, in some cases in a hidden file or the %TEMP% directory, enabling victims to recover files without paying. The research also documented Telegram-based automation, destructive wiper behavior, and test/debug artifacts that suggest immature development practices.
In November 2025, CyberVolk expanded beyond ransomware by offering a standalone remote access trojan and keylogger for sale. This marked a broader monetization push alongside its Telegram-managed ransomware service.
In August 2025, the pro-Russia hacktivist group CyberVolk re-emerged and launched a new ransomware-as-a-service operation called VolkLocker, also referred to as CyberVolk 2.x. The Golang-based ransomware was built to target both Windows and Linux, including VMware ESXi environments.
CyberVolk went through a period of inactivity after Telegram enforcement actions disrupted the group's accounts and infrastructure. Multiple later reports cite this disruption as the reason for the group's temporary dormancy before its return.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcego.theregister.com
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified **Vect** as a new ransomware-as-a-service operation advertising a purportedly custom-built C++ locker for **Windows, Linux, and VMware ESXi**. The group began recruiting affiliates on a Russian-language cybercrime forum and promotes features including **ChaCha20-Poly1305** encryption, intermittent encryption for faster impact, Safe Mode execution, SMB and WinRM propagation, GPO-based deployment, and built-in packing or crypter functionality. Vect also operates **TOR-only** infrastructure for affiliate onboarding, victim communications, and leak-site publishing, and appears to follow a **double-extortion** model. The group has publicly claimed two victims in **Brazil** and **South Africa**, although neither the intrusions nor the full malware capabilities have been independently verified. Researchers said Vect shows unusually strong operational maturity for a newly observed crew, citing Monero payments, TOX communications, and a revenue-sharing model that waives entry fees for CIS-based affiliates while charging non-CIS applicants. Reporting suggests the operators may be experienced ransomware actors or a rebrand, and defenders were urged to harden exposed **RDP/VPN** and edge appliances such as Fortinet interfaces, segment management networks, watch for Safe Mode abuse and intermittent encryption, and strengthen anti-ransomware controls.
Jul 2, 2026
The newly identified pro-Ukrainian ransomware-as-a-service operation **VantaCore** has targeted at least seven Russian organizations since August 2026, demanding multimillion-dollar payments through a Tor-based victim-chat service. Russian cybersecurity firm F6 assesses that VantaCore is likely a rebrand of the Thor group; its leak site was established in early June, and the operation appears more financially motivated than its predecessor while retaining an apparent political focus on Russian targets. VantaCore gains initial access through insecure VPNs and remote-access services, vulnerabilities in internet-facing applications, and credentials stolen from business partners. Its custom toolkit—**VantaCore ransomware**, `VantaCoreLoader`, `VantaCoreRAT`, and `SnowKiller`—supports payload delivery, encryption, reconnaissance, remote access, file transfers, command execution, and security-tool disabling. Victim data may be published, sold, or used in follow-on activity if ransom demands are not met; F6 characterized the group’s methods as effective but not especially novel or sophisticated.
Sep 4, 2026
Researchers reported that **LokiLocker** is a relatively new ransomware-as-a-service family targeting **Microsoft Windows** systems through a small, vetted affiliate network, with activity observed across Eastern Europe, Asia, and English-speaking victims. The malware, first seen in the wild in 2021, encrypts files using **AES** with **RSA**-protected keys, demands payment by email, and is written in **.NET** with **NETGuard** and the **KoiVM** virtualization plugin to complicate reverse engineering. Early infections were linked in some cases to trojanized brute-checker tools, and no free decryptor was available. BlackBerry researchers said the operation may be using **false-flag indicators** to obscure attribution, citing Iranian-linked clues such as affiliate usernames, cracking tools associated with the **AccountCrack** team, and an Iran exclusion list in code, while cautioning that the true origin remains unclear. LokiLocker is also notable for a configurable **wiper** function that can delete non-system files, overwrite the **Master Boot Record (MBR)**, and force a **Blue Screen of Death** if victims refuse to pay, increasing the risk of destructive impact beyond conventional ransomware encryption.
Aug 15, 2026