Loading story…
HelloKitty ransomware emerged as a targeted extortion threat that gained broad attention after being linked to the attack on game studio CD Projekt Red. Researchers described the malware as less stealthy than major families such as Ryuk, REvil, and Conti, but still highly disruptive, with operators using Tor-based payment portals, customized ransom notes, and in some cases auctioning stolen data on underground forums. The family has also been referred to as Kitty, and reporting tied it to later variants and related offshoots including FiveHands, Kitty Go, Kitty Linux, Vice Society, and Boombye.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Vice Society emerged in June 2021 as a probable HelloKitty spin-off. The variant used Windows and Linux encryption based on OpenSSL, according to the profile.
On May 9, 2021, the Kitty Go variant targeted Western Pathology in the United States. Its ransom note claimed the attackers had stolen more than 1 TB of data from the victim.
Reporting cited by SentinelLabs said data stolen from CD Projekt Red was being auctioned on underground forums. The reported sale appeared legitimate at the time of writing.
CD Projekt Red disclosed that it had suffered a targeted and highly impactful ransomware attack. SentinelLabs reported the attack was widely attributed to the HelloKitty ransomware family.
A HelloKitty variant dated January 28, 2021 used the .crypted extension and dropped the ransom note read_me_lkd.txt. The variant reflects continued evolution of the ransomware family after its initial emergence.
A late-December 2020 HelloKitty variant targeted Brazilian companies and referenced CEMIG in its extortion message. This variant used the .kitty extension and the ransom note read_me_lkdtt.txt.
HelloKitty ransomware activity began around mid-November 2020 and was oriented primarily toward English-speaking victims while spreading globally. Multiple sources describe the family as first seen in late 2020.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourceblog.emsisoft.com
Open sourceid-ransomware.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Kraken ransomware group, a successor to the HelloKitty cartel, has emerged as a significant threat in 2025, conducting big-game hunting and double extortion attacks across multiple countries, including the United States, United Kingdom, Canada, Denmark, Panama, and Kuwait. Kraken targets enterprise environments running Windows, Linux, and VMware ESXi, leveraging Server Message Block (SMB) vulnerabilities for initial access, and employing tools such as Cloudflared for persistence and SSHFS for data exfiltration. Notably, Kraken benchmarks victim machines before encryption, a rare feature that allows the ransomware to optimize its encryption process and avoid overloading systems, choosing between full and partial encryption based on system performance. Kraken's operations are characterized by the use of a data leak site for extortion, where stolen data is published if ransom demands are not met, and the deployment of ransom notes titled "readme_you_ws_hacked.txt". The group has also established a new underground forum, "The Last Haven Board," to facilitate secure communications within the cybercrime community. The ransomware's connection to the defunct HelloKitty operation is evident through similarities in tactics and ransom notes, as well as the timing of its emergence following HelloKitty's source code leak. Kraken's opportunistic targeting and advanced techniques underscore its growing impact on the global ransomware landscape.
Jun 29, 2026
CISA warned that threat actors are actively exploiting **`CVE-2019-7481`** in SonicWall **Secure Mobile Access (SMA) 100** series and **Secure Remote Access (SRA)** appliances that remain on end-of-life firmware, with intrusions leading to targeted ransomware attacks. SonicWall issued an urgent notice telling customers to upgrade to supported firmware immediately or disconnect affected appliances, underscoring that patched but unsupported devices remain exposed if they have not been properly updated. Reporting linked the campaign to multiple eCrime actors, including **HelloKitty**, and CrowdStrike identified the SonicWall flaw as a key access vector being leveraged in the wild. The activity fits a broader pattern of ransomware groups abusing SonicWall edge devices for initial access, with prior exploitation by actors associated with **Babuk**, **UNC2447**, and **UNC2682** across VPN and email security products.
Aug 15, 2026
BlackCat/ALPHV affiliates carried out targeted double-extortion attacks by stealing data and deploying ransomware across Windows, Linux, and VMware ESXi environments, using a Rust-based payload that supports extensive customization. Reporting from Microsoft, Netskope, and Forescout shows the group gaining initial access through several routes, including compromised RDP credentials, exploitation of an unpatched Exchange server, an Internet-exposed SonicWall firewall, and a contractor account compromised via a malicious browser extension that led to virtual desktop access without MFA. After entry, operators escalated privileges, enumerated domains and devices, dumped credentials, and moved laterally with legitimate tools such as **PsExec** before staging broad encryption operations. In one analyzed intrusion, attackers used a compromised domain account to push the **ExMatter** exfiltration tool and the BlackCat payload to more than 2,000 machines, with ExMatter collecting selected file types and sending them over WebDAV to attacker-controlled infrastructure. Researchers also documented BlackCat features including self-propagation via NetBIOS discovery, shadow copy deletion, service termination, event log clearing attempts, and ESXi-specific actions such as stopping virtual machines and deleting snapshots. Separate technical analysis and tooling published by defenders showed that BlackCat binaries embed configurable options for ransom notes, propagation, encryption behavior, and virtualization-focused disruption, underscoring how affiliates adapt the malware to different victim environments.
Aug 15, 2026