HelloKitty Ransomware Reemerges to Target Windows, Linux, and ESXi Systems

The notorious HelloKitty ransomware group, initially identified in October 2020, is making a resurgence, posing significant threats to Windows, Linux, and ESXi systems.

Initially derived from the DeathRansom ransomware, HelloKitty has undergone continuous evolution, integrating elements from other ransomware families like FiveHands.

Its return signals renewed sophistication and adaptability in targeting enterprise environments, particularly virtualization platforms.

Coded predominantly in Visual C++ and utilizing UPX compression for obfuscation, HelloKitty encrypts victims’ files by appending extensions such as .CRYPTED, .CRYPT, or .KITTY.

The ransomware operates stealthily, avoiding self-identification in ransom notes an anomaly compared to other ransomware groups.

Ransom notes instead address victims directly by name, underscoring a more personalized, psychological approach to extortion.

Technical Advancements and New Variants

HelloKitty’s encryption methods highlight its technical complexity. It employs RSA-2048 public keys for secure encryption of file-specific AES keys.

By leveraging a combination of Salsa20 and AES cryptographic algorithms, the ransomware achieves robust data encryption, rendering recovery without a decryption key nearly impossible.

Notably, distinct metadata, including the RSA-encrypted AES key and unique victim identifiers, is appended to affected files.

The ransomware group also targets critical system processes and data backups using advanced techniques.

These include querying and deleting shadow copies, injecting malicious code into legitimate processes, disabling security services, and employing Windows Management Instrumentation (WMI) for persistence. Such tactics ensure maximum disruption to the victim organization.

In 2024, multiple new HelloKitty samples emerged, marking a significant spike in activity, particularly in September.

According to the Report, these variants included updates in their communication protocols, encryption processes, and operational infrastructure.

Samples uploaded to VirusTotal revealed ties to various geographic locations, including China, Argentina, and Romania, indicating a potential collaboration among multiple operators.

Throughout its history, HelloKitty’s victim portfolio has included high-profile targets such as CD Projekt Red (Poland), Cemig Power Plant (Brazil), and healthcare and IT services in the UK and France.

Despite its relatively small victim base compared to other ransomware groups, HelloKitty’s impact has been substantial, often causing significant operational and financial disruption to its targets.

Attribution of the group remains contentious. Early investigations by agencies like the FBI and CISA traced operations to Ukraine, while subsequent analyses pointed to Chinese involvement.

Artifacts such as Chinese language remnants, communication with Chinese IPs, and the predominance of uploads from China have led researchers to suspect a strong Chinese operational link.

However, some argue these indicators could be deliberate attempts to mislead attribution efforts.

Deployment by Other Threat Actors

Over time, HelloKitty has been integrated into the arsenals of other threat actors, including Vice Society, UNC2447, and Lapsus$.

This reuse underscores its effectiveness as a ransomware tool, with its modular design allowing easy adaptation for distinct attack scenarios.

In 2025, HelloKitty remains a relevant and evolving cyber threat. Recent samples show revised codebases, indicating ongoing development aimed at enhancing functionality and bypassing modern security measures.

Despite the absence of active TOR onion domains linked to the group, new samples suggest that HelloKitty operators may be constructing new infrastructure for future campaigns.

As cybersecurity defenses advance, HelloKitty’s persistence highlights the necessity for organizations to continuously update their security frameworks.

With its ability to adapt and its global footprint, HelloKitty remains a formidable adversary in the ever-changing ransomware landscape.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates