HelloKitty

HelloKitty is a human-operated double-extortion ransomware operation active since November 2020. The group is known for hacking corporate networks, stealing data, and encrypting systems, then threatening to leak stolen data if victims do not pay. One of its most publicized attacks was the February 2021 attack on CD Projekt Red, during which the actors claimed to have stolen source code for Cyberpunk 2077, Witcher 3, Gwent, and other games. In summer 2021, the operation began using a Linux variant targeting VMware ESXi. Reported aliases or related variant names in the provided content include DeathRansom and Fivehands; the content also notes a possible association with Abyss Locker. The malware has been observed deleting volume shadow copies on compromised hosts to inhibit recovery. Multiple sources in the provided content state that HelloKitty later became defunct, that its source code leaked, and that Kraken emerged from the remnants of or as a continuation of the HelloKitty operation. The content also states that some Conti leaders and affiliates dispersed into other ransomware ecosystems including HelloKitty.