Lucky_Gh0$t
Lucky_Gh0$t is a Windows ransomware family identified in early 2025 and described as a Yashma variant, with Yashma itself being the sixth iteration of the Chaos ransomware series. Reporting cited in the content characterizes Lucky_Gh0$t as a Chaos/Yashma-family ransomware variant with only minor modifications to the ransomware binary, and notes it marked a shift toward more destructive behavior. It is explicitly distinct from the separate 2025 ransomware-as-a-service group also named Chaos.
Observed distribution involved fake AI-tool installers, especially a self-extracting archive masquerading as a ChatGPT installer, including filenames such as "ChatGPT 4.0 full version - Premium.exe." The campaign used SEO poisoning, Telegram, and social media or messenger channels to lure victims. The malicious package contained a ransomware executable named dwn.exe, chosen to resemble the legitimate Windows process name dwm.exe, and also bundled legitimate Microsoft open-source AI tools from GitHub to appear trustworthy and potentially evade detection. The malware was also referenced in reporting on fake "ChatGPT 4.0 Premium" installers targeting Windows users.
Lucky_Gh0$t retains Yashma capabilities including evasion techniques, deletion of volume shadow copies and backups, and hybrid AES-256 plus RSA-2048 encryption. Its file handling is size-dependent: files smaller than approximately 1.2 GB are encrypted and renamed with a random 4-character alphanumeric extension. For files larger than approximately 1.2 GB, Lucky_Gh0$t creates a same-sized replacement file containing a single question mark character, appends a random 4-character extension, and deletes the original file, causing destructive data loss rather than conventional encryption. Ransom notes include a personal ID and instruct victims to contact the operator through getsession[.]org using a unique session ID.
The malware has been documented in campaigns abusing interest in AI tools and was highlighted alongside other threats such as CyberLock and Numero. Reporting noted elevated risk to users and organizations in B2B sales, technology, and marketing sectors because the impersonated AI tools are popular in those environments.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniques
Resource Development
Seven campaigns used paid search ads or search engine poisoning. The technique is straightforward: buy an ad for "install [AI tool]" and serve a convincing clone.
Threat actors are employing a variety of techniques and channels to distribute these fraudulent installers, including SEO-poisoning tactics to manipulate search engine rankings and cause their malicious websites or download links to appear at the top of search engine results.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Stealth
1 technique
Stealth
Collection
1 technique
Collection
Impact
3 techniques
Impact
For the targeted files with a size larger than 1.2GB, the ransomware creates a new file the same size of the original file and writes a single character “?” as the file content... deletes the original file, exhibiting destructive behavior.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows ransomware delivered via a fake ChatGPT installer; uses AES-256 and RSA-2048 encryption.
Ransomware family distributed via fake AI tool installers (as referenced).
A Chaos variant (early 2025) using AES + RSA that encrypts targeted files and replaces the contents of files larger than 1.3GB with identical bytes (destructive/wiper-like behavior) rather than traditional encryption for those large files.
A Chaos variant (early 2025) using AES + RSA that introduces destructive behavior by replacing contents of files larger than 1.3GB with identical bytes (rapid irreversible data destruction) while still encrypting smaller/medium files.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.