Loading story…
Researchers analyzed HildaCrypt, a Windows ransomware family written in C# that was distributed as a fake XAMPP installer named xamp.exe and obfuscated with ConfuserEx. Once launched, it created a GUID-named folder under %AppData%\Roaming%, ran a batch script, deleted shadow copies, and attempted to stop SQL, backup, and anti-malware services before encrypting files. The malware used AES-256-CBC for file encryption, appended the .HCY! extension, and stored the AES key and IV in each file after encrypting them with an embedded RSA-2048 public key; it then dropped an HTML ransom note, HILDACRYPTReadMe.html, directing victims to contact the operator by email.
A separate development reduced the threat to victims after the ransomware’s developer released HildaCrypt’s master private decryption keys. Researcher GrujaRS had initially classified a sample as a STOP ransomware variant, but the author later said it was a HildaCrypt variant, and Michael Gillespie confirmed the keys were valid and published a working decryptor. The developer claimed the malware was created for “fun” and educational purposes, said it had not been used against anyone, and indicated development was likely ending as they moved toward legitimate cybersecurity work.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The HildaCrypt sample analyzed by Acronis had a compilation timestamp indicating it was built on September 14, 2019. The sample was a PE32 .NET Assembly for Windows written in C# and obfuscated with ConfuserEx.
HildaCrypt ransomware was discovered in August 2019. Researchers identified it as a ransomware family that masqueraded as a fake XAMPP installer and targeted backup and anti-virus related services.
Michael Gillespie confirmed the released HildaCrypt private keys were legitimate and published a working decryptor based on them. This enabled free decryption for affected victims and others could also inspect the keys or build their own tools.
The developer behind HildaCrypt released the ransomware's master private decryption keys, allowing victims to recover files for free. The keys were provided after a newly found sample was initially misidentified as a STOP ransomware variant and then clarified by the developer as HildaCrypt.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hive emerged as a prolific ransomware-as-a-service operation that heavily targeted healthcare and other enterprises, using **double extortion** to steal data and encrypt systems. Reporting tied the group to intrusions involving phishing, vulnerable RDP, stolen VPN credentials, and possible exploitation of Microsoft Exchange `ProxyShell`, followed by lateral movement with RDP and WMI, use of Cobalt Strike, shadow-copy deletion, and exfiltration through tools such as 7-Zip and anonymous file-sharing services. The group expanded beyond Windows with Linux and FreeBSD encryptors, including VMware ESXi-focused variants, and was linked to major disruptions at hospitals and other organizations. At the same time, academics from Kookmin University published a decryption method that exploited weaknesses in Hive’s custom XOR-based file-encryption design, reporting recovery of more than **95%** of the master key and decryption of roughly **82% to 98%** of affected files without the attackers’ private key. Subsequent public research and proof-of-concept tooling documented Hive version-specific decryptors and analysis resources, while the ransomware operators responded by hardening their malware, including rewriting the Linux ESXi encryptor in **Rust** and moving ransom-site credentials out of embedded samples and into runtime command-line arguments to reduce analysis and monitoring opportunities.
Aug 15, 2026
Researchers identified **CryptoHost**, also tracked as **Manamecrypt**, as a ransomware family that did not truly encrypt files but instead moved targeted data into a password-protected **RAR** archive and demanded **0.33 Bitcoin** for recovery. The malware reportedly stored both the archive and its executable under `AppData\Roaming`, established persistence through a **Run** registry key, and verified exact ransom payments through **blockchain.info** before releasing files. It was also reported as being bundled with a **uTorrent** installer and detected by security products as **`Ransom:MSIL/Manamecrypt.A`** and **`Ransom_CRYPTOHOST.A`**. Analysis of the malware showed the archive password was generated predictably from the archive name and the victim username, allowing affected files to be recovered without paying the ransom. Researchers also said the threat attempted to frustrate remediation by deleting the **SafeBoot** registry key and terminating processes associated with security tools, administration, gaming, shopping, and social-media applications. While some reports described the attacks as highly disruptive for users and companies, they also warned that ransom payment via **Bitcoin** remained risky and offered no guarantee of successful recovery, reinforcing the need for preventive security controls and backups.
Aug 15, 2026
Avaddon emerged as a **ransomware-as-a-service** operation that initially spread through a massive phishing campaign using smiley-themed lures such as “Your new photo?” and JavaScript attachments disguised as images. The malware downloaded its payload with PowerShell and `BITSAdmin`, encrypted files with the `.avdn` extension, dropped HTML ransom notes, changed desktop wallpaper, and directed victims to Tor-based payment pages. Researchers and vendors linked early distribution to large botnet-driven spam activity and later observed affiliates using additional access methods including exposed **RDP**, weak **VPN** credentials, and network vulnerability exploitation. As the operation matured, Avaddon expanded into multi-extortion, publicly listing victims on a leak site, releasing stolen data, and in some cases adding **DDoS** pressure while continuously updating its code to evade detection and defeat public decryptors. Reports described anti-analysis features, persistence via scheduled tasks and Run registry keys, deletion of backups and shadow copies, and regional exclusions that avoided CIS-language systems. After becoming one of the most active ransomware threats and drawing warnings from authorities, the group abruptly shut down and released **2,934 decryption keys**, which were validated by incident-response firms and used to build a free decryptor for victims.
Aug 15, 2026