CyberVolk Hackers Group With New VolkLocker Payloads Attacks both Linux and Windows Systems
## Cybersecurity: CyberVolk's VolkLocker Ransomware
Cybersecurity: CyberVolk's VolkLocker Ransomware
CyberVolk, identified as a pro-Russia hacktivist group, has introduced a new ransomware platform known as VolkLocker after a hiatus in 2025.
The group, initially documented in late 2024 for activities aligned with Russian governmental interests, had ceased operations due to enforcement actions on Telegram. However, they reemerged in August with a sophisticated Ransomware-as-a-Service platform that integrates encryption capabilities with Telegram-based automation.
VolkLocker supports both Linux and Windows systems, leveraging Golang for cross-platform functionality. This approach enhances the group's capability to target diverse organizational infrastructures.
Initial builds are not obfuscated. Operators are advised to apply UPX packing for enhanced protection, departing from the native crypting features prevalent in other ransomware-as-a-service models.
CyberVolk, identified as a pro-Russia hacktivist group, has introduced a new ransomware platform known as VolkLocker after a hiatus in 2025.
Analysis by SentinelOne reveals rapid expansion of VolkLocker, yet notes operational weaknesses that potentially allow recovery by victims. Examination of the malware code uncovers test artifacts, indicating hurried development and incomplete security protocols.
The malware employs advanced privilege escalation techniques upon execution. Specifically, VolkLocker uses the "ms-settings" User Account Control bypass by manipulating the registry key HKCU\Software\Classes\ms-settings\shell\open\command to gain elevated privileges. This method exploits legitimate Windows settings to circumvent security controls without user notifications.
Once escalated, the malware accesses protected files and system directories across networks. It conducts process enumeration to detect virtual environments, avoiding execution in sandbox settings by checking MAC addresses and service names.
Organizations are advised to implement comprehensive detection mechanisms, privilege escalation monitoring, and registry access controls to counteract VolkLocker’s attack methodologies.
Based on reporting by Cyber Security News.