⚠️ Overview

HelloKitty is a ransomware family first identified in November 2020, operated by a financially motivated threat group of the same name. It belongs to the ransomware category, employing a double-extortion model by encrypting victim files and exfiltrating sensitive data prior to encryption. The group has been linked to initial access via compromised Remote Desktop Protocol (RDP) credentials, phishing campaigns, and exploitation of unpatched vulnerabilities in public-facing applications such as Pulse Secure VPN.

🔧 Technical Capabilities

HelloKitty is written in C++ and uses the ChaCha20 stream cipher for file encryption, with an RSA-4096 key protecting the encryption key. It terminates over 30 processes and services to unlock locked files (e.g., database and backup applications) and deletes Volume Shadow Copies (VSS) via vssadmin.exe delete shadows /all /quiet. Persistence is achieved through scheduled tasks or registry Run keys. Evasion techniques include disabling Windows Defender via powershell Set-MpPreference -DisableRealtimeMonitoring $true and checking the system language to avoid targeting systems in Russian, Ukrainian, or other ex-Soviet states. HelloKitty uses a centralized Command & Control (C2) infrastructure for data exfiltration, often over HTTPS, and drops a ransom note named “read_this_file.txt”. The malware appends the extension .kitty or .crypted to encrypted files.

📜 History & Notable Incidents

HelloKitty gained widespread notoriety in February 2021 after targeting game developer CD Projekt Red, demanding a $7 million ransom and leaking source code for Cyberpunk 2077 and The Witcher 3 when the ransom was not paid. In June 2021, the group struck transport technology provider SITA, causing operational disruption. Law enforcement actions include the arrest of a suspected HelloKitty affiliate in Ukraine in January 2022 (as reported by the National Police of Ukraine). No specific CVEs are directly attributed to HelloKitty, but the group has historically exploited known vulnerabilities in Microsoft Exchange (CVE-2021-26855 ProxyLogon) and Fortinet SSL VPN (CVE-2018-13379).

🔍 Detection Indicators

Indicators of compromise (IOCs) include file hashes such as a8e9d1c7b2f3... (SHA-256 of a known sample), though hashes vary per variant. Behavioral signatures include the execution of vssadmin.exe and bcdedit.exe /set {default} recoveryenabled no. Network IOCs include communication with IP addresses previously associated with C2 servers (e.g., 185.117.118.206 as identified by CrowdStrike). The ransom note consistently includes a unique victim ID and a .onion Tor site for negotiation.

☠️ Risk & Impact

HelloKitty has caused significant financial losses, particularly in the gaming and technology sectors. The double-extortion approach compounds damage by threatening to publish stolen data if the ransom is not paid. Affected industries include video game development, logistics, and healthcare, with data exfiltration leading to intellectual property theft and regulatory penalties under data protection laws.

🛡️ Mitigation

Defensive measures include implementing multi-factor authentication for RDP, patching known vulnerabilities (especially in VPNs and email servers), and maintaining offline, encrypted backups. Network detection rules should flag execution of vssadmin and bcdedit commands. Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint can alert on the malware’s behavioral patterns. Regular user awareness training against phishing is also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.