RegretLocker ransomware encrypts files inside Hyper-V virtual disks

Researchers documented RegretLocker, a ransomware family that targets Windows systems and stands out for mounting Hyper-V virtual hard disks such as VHD and VHDX through the Windows Virtual Storage API, then encrypting the files inside those disks instead of encrypting the container files directly. Victim files are renamed with the .mouse extension, and the malware drops a ransom note named HOW TO RESTORE FILES.TXT. The approach can accelerate encryption and improve impact in virtualized environments, while the malware also attempts to encrypt ordinary files, large files, USB-attached storage, and SMB-accessible network shares.

Technical analysis found that RegretLocker uses AES for file encryption and retrieves an RSA public key from a Tor-based command-and-control server, with a hard-coded fallback key available when offline. It also deletes shadow copies and backups, disables recovery options, establishes persistence through the Windows Run registry key and a scheduled task, and uses the Windows Restart Manager API and taskkill to terminate processes or services that keep files open, while avoiding some remote-access and core system processes. Researchers said the code used to mount virtual disks appeared to draw on recently published security research, and they published hashes, network indicators, and a YARA rule to aid detection.