HelloKitty samples were retrieved from their campaigns targeting Linux systems at the end of 2021... Oldest samples from 2021 are HelloKitty ransomware for Linux (ELF binaries), and most recent ones (June 2022) are Zeppelin ransomware.
HELLOKITTY
HelloKitty, also known as Kitty, is a human-operated ransomware family first observed in late 2020.
Profile source: Mallory opens in a new tabHELLOKITTY
Family profile
HelloKitty, also known as Kitty, is a human-operated ransomware family first observed in late 2020. It encrypts victim data and presents customized ransom notes that direct victims to Tor-based negotiation and payment portals. Windows variants have used AES encryption with RSA-2048 or NTRU public-key protection, while Linux variants have used AES-256 with ECDH-based key protection. Variants have been implemented in C++ and Go.
HelloKitty disables processes and services that could impede encryption, including enterprise application, database, messaging, backup, and web-server components. It can enumerate running processes and network resources, terminate selected processes and services, and delete shadow copies. Windows samples use built-in utilities, WMI, and the Windows Restart Manager API to identify and stop processes. The family uses a mutex to prevent concurrent execution.
HelloKitty has Windows and Linux encryptors, including Linux ELF payloads designed for VMware ESXi hosts. Its ESXi-focused variant uses the ESXi management interface to enumerate running virtual machines and attempts graceful, hard, and forced VM shutdown before encrypting virtual-disk, metadata, and snapshot files. Targeting hypervisors enables a single ransomware deployment to disrupt multiple virtualized workloads.
HelloKitty was provisionally linked to the February 2021 ransomware attack against CD Projekt Red, where attackers encrypted systems and claimed theft of game source code and internal business data. HelloKitty-associated activity has also been linked to exploitation of vulnerable SonicWall remote-access appliances and Apache ActiveMQ systems. The family has been used in campaigns against organizations globally, including enterprises and virtualization infrastructure. Phishing and secondary deployment following other malware infections have also been reported as delivery methods.
Capabilities
- Defense Evasion
- Extortion
- Initial Access
- Reconnaissance
Operational record
1
YARA rules
1
Leak sites
0 available
Reported operators
Threat actors
5 named in public reportingIn July 2021 an encryptor that targeted explicitly VMware ESXi systems was discovered.
This activity group also developed and deployed the FiveHands and HelloKitty ransomware payloads and often gained access to an organization via DEV-0193’s BazaLoader infrastructure.
A threat actor has leaked the complete source code for the first version of the HelloKitty ransomware on a Russian-speaking hacking forum, claiming to be developing a new, more powerful encryptor.
HELLOKITTY ransomware—used to target Polish video game developer CD Projekt Red—is reportedly built from DEATHRANSOM.
Exploited software
Vulnerabilities linked to HELLOKITTY
4 CVEsMITRE ATT&CK
HELLOKITTY in ATT&CK
33 distinct techniquesTechniques
33 techniques T1497 Virtualization/Sandbox Evasion T1057 Process Discovery T1537 Transfer Data to Cloud Account T1047 Windows Management Instrumentation T1567.003 Exfiltration to Text Storage Sites T1135 Network Share Discovery T1489 Service Stop T1082 System Information Discovery T1490 Inhibit System Recovery T1486 Data Encrypted for Impact T1189 Drive-by Compromise T1566 Phishing T1567 Exfiltration Over Web Service T1071 Application Layer Protocol T1190 Exploit Public-Facing Application T1566.001 Spearphishing Attachment T1133 External Remote Services T1021 Remote Services T1070 Indicator Removal T1059 Command and Scripting Interpreter T1529 System Shutdown/Reboot T1012 Query Registry T1070.004 File Deletion T1059.003 Windows Command Shell T1112 Modify Registry T1005 Data from Local System T1203 Exploitation for Client Execution T1657 Financial Theft T1218.007 Msiexec T1210 Exploitation of Remote Services T1120 Peripheral Device Discovery T1036 Masquerading T1680 Local Storage Discovery
Reporting
Research mentioning HELLOKITTY
Mar 22
Sentinelone Labs Subdomain
Multi-Platform SMAUG RaaS Aims To See Off Competitors - SentinelLabs
SMAUG is a ransomware-as-a-service (RaaS) operation that advertises 64-bit payloads for Windows, Linux, and macOS, positioning itself as a multi-platform option for affiliates. The service reportedly charges a 20% affiliate fee plus a 0.2 BTC registration fee, and provides a web-based campaign builder, customizable ransom demands, offline encryption, and a "Company Mode" that allows a single decryption key to unlock multiple systems inside one targeted organization. Victims are directed to a Tor-based payment portal, while operators reportedly offer automated support for both affiliates and victims and bar attacks against CIS countries. On Windows, SMAUG uses obfuscated Go binaries that gather system details and stored browser credentials, establish persistence through Registry Run Keys consistent with MITRE ATT&CK T1547.001, and then encrypt files for impact using AES-256 with keys protected by RSA-2048, aligning with T1486 Data Encrypted for Impact tradecraft. The combination of credential collection, registry-based autostart, and hybrid cryptography reflects a mature ransomware model designed to support repeatable intrusions and broad enterprise targeting across multiple operating systems.
Nov 26
Compass Security
VPN Appliance Forensics - Compass Security Blog
CISA warned that threat actors are actively exploiting CVE-2019-7481 in SonicWall Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) appliances that remain on end-of-life firmware, with intrusions leading to targeted ransomware attacks. SonicWall issued an urgent notice telling customers to upgrade to supported firmware immediately or disconnect affected appliances, underscoring that patched but unsupported devices remain exposed if they have not been properly updated. Reporting linked the campaign to multiple eCrime actors, including HelloKitty, and CrowdStrike identified the SonicWall flaw as a key access vector being leveraged in the wild. The activity fits a broader pattern of ransomware groups abusing SonicWall edge devices for initial access, with prior exploitation by actors associated with Babuk, UNC2447, and UNC2682 across VPN and email security products.
Sep 2
Sentinelone Labs Subdomain
HelloKitty Ransomware Lacks Stealth, But Still Strikes Home - SentinelLabs
HelloKitty ransomware emerged as a targeted extortion threat that gained broad attention after being linked to the attack on game studio CD Projekt Red. Researchers described the malware as less stealthy than major families such as Ryuk, REvil, and Conti, but still highly disruptive, with operators using Tor-based payment portals, customized ransom notes, and in some cases auctioning stolen data on underground forums. The family has also been referred to as Kitty, and reporting tied it to later variants and related offshoots including FiveHands, Kitty Go, Kitty Linux, Vice Society, and Boombye.
Jul 17
Bleeping Computer
HelloKitty ransomware is targeting vulnerable SonicWall devices
Feb 11
Emsisoft
HelloKitty ransomware group likely responsible for CD Projekt attack. Here’s why.
Oct 1
Id Ransomware
