Loading story…
A ransomware strain dubbed WannaFriendMe was found directing victims to buy a Roblox Game Pass named "Ryuk Decrypter" with Robux and then email proof of purchase to an iCloud address to obtain a decryptor. Researchers and reporting tied the malware not to Ryuk, despite its branding, but to the Chaos ransomware family, a .NET builder-based strain that lets operators customize ransom notes, file extensions, and other behaviors. Roblox said the incident did not involve a platform vulnerability, and the company removed the Game Pass and permanently banned the account behind it.
The case highlighted the real-world abuse potential of the Chaos builder, which security researchers had previously tracked as an evolving proof of concept with destructive behavior closer to a wiper than conventional ransomware. Trend Micro and Qualys reported that successive Chaos versions added privilege escalation, shadow-copy deletion, recovery disabling, wallpaper changes, and AES/RSA encryption for smaller files, while files larger than roughly 2 MB were overwritten with random data and often rendered unrecoverable. That design means victims may lose data even if a decryptor is provided, making WannaFriendMe notable both for its unusual Roblox-based payment scheme and for the severe data-destruction risks inherited from Chaos.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
On January 17, 2022, Qualys published analysis of the latest observed Chaos version and assessed that it behaved more like a wiper than traditional ransomware. The report detailed its encryption of files smaller than about 2 MB and destructive overwriting of larger files.
On August 10, 2021, Trend Micro published research on Chaos, documenting its rapid evolution across four versions and warning that it could become dangerous if paired with effective malware deployment infrastructure. The researchers said they had not observed active infections or victims at that time.
Chaos version 4.0 was released on August 5, 2021. It raised the encryption limit to about 2 MB and added customizable file extensions and wallpaper changes.
Chaos version 3.0 was released on July 5, 2021. It added AES/RSA encryption for files under 1 MB and included a decrypter builder, marking a shift toward more typical ransomware behavior.
Chaos version 2.0 was released on June 17, 2021. It added options for administrator privileges and capabilities to delete shadow copies, backup catalogs, and disable Windows recovery mode.
Chaos version 1.0 was released on June 9, 2021. This early version overwrote targeted files with random bytes and Base64-encoded them, behaving more like a destructive wiper than conventional ransomware.
Researchers began monitoring the in-development Chaos ransomware builder in June 2021 after it was offered for testing on an underground forum. It was advertised as a .NET version of Ryuk despite sharing little with the Ryuk family.
Roblox said the incident did not involve any exploit or vulnerability on its platform. The company removed the Game Pass associated with the ransomware decryptor and permanently removed the responsible account for violating its Terms of Service.
Security researcher MalwareHunterTeam found a new ransomware strain named WannaFriendMe. The malware impersonated Ryuk but was actually a Chaos ransomware variant that instructed victims to buy a Roblox Game Pass as payment for a decryptor.
A Roblox Game Pass named 'Ryuk Decrypter' tied to the WannaFriendMe ransom scheme had last been updated on June 5th. The listing was sold by a user named 'iRazormind' for 1,499 Robux.
In October, threat actors targeted Japanese Minecraft players with purported 'alt lists' containing stolen accounts that instead deployed a Chaos ransomware variant. This was cited as a prior example of Chaos variants being used against gamers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceblog.qualys.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Play ransomware** group, also tracked as **PlayCrypt** and attributed by Symantec to **Balloonfly**, has conducted double-extortion intrusions since 2022 while refining both its initial access and post-compromise tradecraft. Symantec reported the group exploited Microsoft Exchange flaws **`CVE-2022-41080`** and **`CVE-2022-41082`**, then used newly observed custom .NET utilities to accelerate victim profiling and data access before encryption. One tool, **Grixba**, surveys domain users, computers, software, services, security products, backup platforms, and remote administration tools, and can also clear logs on local and remote systems; another uses the **AlphaVSS** library to copy files from **Volume Shadow Copy Service** snapshots, including files normally locked by the operating system. Reverse-engineering of the Play encryptor shows a ransomware family built for enterprise attacks, using a hybrid **RSA-AES** scheme, heavy obfuscation, API hashing, and anti-analysis techniques. The malware has been linked with tools and access methods including **SystemBC RAT**, **Cobalt Strike**, **AdFind**, **WinPEAS**, **WinSCP**, **RDP**, and **SMB**, and it enumerates local and network drives, skips selected files and directories, encrypts files in size-based chunks, appends the **`.PLAY`** extension, and drops a **`ReadMe.txt`** ransom note. Researchers also noted a coding flaw that can cause files to be renamed even when encryption does not complete successfully, underscoring both the malware’s sophistication and its ongoing evolution.
Aug 15, 2026
Security researchers reported that **RuRansom** is a destructive malware strain aimed at systems geolocated in Russia, presenting itself as ransomware while functioning primarily as a wiper. The malware checks a victim’s public IP address through external services and exits unless the host appears to be in Russia, then seeks elevated privileges, scans local, removable, and network drives, deletes `.bak` backup files, and encrypts files with **AES/AES-CBC** while appending the `.fs_invade` extension. It also drops a Russian-language note stating there is no decryption or payment path, underscoring that the operation is intended to damage Russian victims rather than extort them. Researchers said the malware is a **.NET 32-bit PE** sample that can spread in worm-like fashion across connected systems and USB devices, including by copying itself as `Россия-Украина_Война-Обновление.doc.exe`. Trend Micro linked RuRansom to the developer behind **dnWipe** and a downloader for **XMRig**, suggesting an actor experimenting with multiple destructive and financially motivated tools, while noting attribution remains unconfirmed. VMware and Cyble also described multiple variants that attempt privilege escalation and appear to have been developed during the Russia-Ukraine cyber conflict, with encrypted files considered effectively irreversible.
Aug 15, 2026
Researchers detailed two separate malware operations that rely on stealth and in-memory execution to steal credentials and maintain remote access. One campaign targeted Roblox exploit users with a trojanized executor branded as **Yuta/Solara**, presenting a polished .NET WPF interface with AI-themed features while silently deploying a PyInstaller-packed Python 3.12 stealer linked to the Glove Stealer family. The malware harvested browser credentials, Roblox cookies, developer secrets, MetaMask vaults, Discord tokens, and Google account artifacts, while using AMSI and ETW patching, Windows Defender tampering, AppLocker evasion, persistence mechanisms, and Discord webhooks for exfiltration.
Jun 29, 2026