CyberVolk, a pro-Russia hacktivist group, has reemerged with a new ransomware platform called VolkLocker following a period of dormancy in 2025.

The group, first documented in late 2024 for conducting attacks aligned with Russian government interests, initially went silent due to Telegram enforcement actions.

However, the group returned in August with a sophisticated Ransomware-as-a-Service offering that combines dangerous encryption features with Telegram-based automation tools.

The VolkLocker platform represents the group’s evolution in attack capabilities, introducing both advanced automation and troubling weaknesses.

The ransomware targets multiple operating systems, with versions written in Golang to support both Linux and Windows environments.

This cross-platform approach significantly expands the group’s attack surface and allows them to compromise diverse organizational infrastructure.

The base builds arrive without obfuscation, and operators are encouraged to use UPX packing for additional protection rather than native crypting features commonly found in competing ransomware-as-a-service offerings.

SentinelOne security analysts noted that VolkLocker payloads reveal the group’s rapid expansion while simultaneously exposing operational immaturities that leave victims with potential recovery opportunities.

Decryption triggered via backed-up key file (Source - SentinelOne) — Decryption triggered via backed-up key file (Source – SentinelOne)

The analysis identifies critical test artifacts embedded within the malware code, suggesting rushed development and incomplete security protocols in the ransomware’s creation process.

Understanding the Privilege Escalation Mechanism

The malware employs sophisticated privilege escalation tactics immediately upon execution. When launched, VolkLocker examines its execution environment and attempts to gain administrative access when necessary.

The primary escalation technique leverages the “ms-settings” User Account Control bypass, which manipulates the registry key HKCU\Software\Classes\ms-settings\shell\open\command to execute with elevated privileges.

CyberVolk (2025) Ransom note HTML (Source - SentinelOne) — CyberVolk (2025) Ransom note HTML (Source – SentinelOne)

This method hijacks legitimate Windows settings functionality to bypass security controls without triggering user warnings.

The privilege escalation process begins by opening the target registry key with appropriate permissions.

The malware then sets string values that redirect the legitimate ms-settings executable to run the ransomware payload with administrator rights.

Once elevated privileges are obtained, the malware can access protected files and system directories across the entire network.

Additionally, VolkLocker performs comprehensive environmental discovery, including process enumeration to detect virtual machines by identifying common virtualization tools like VirtualBox, VMware, and QEMU agents.

The malware cross-references running processes against known virtual environment service names and checks MAC addresses against vendor prefixes to avoid execution in sandbox environments.

This detection evasion strategy allows the malware to target production systems while avoiding security researcher analysis in isolated laboratory environments.

Organizations must implement robust detection mechanisms, privilege escalation monitoring, and registry access controls to defend against VolkLocker’s sophisticated attack chain.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post CyberVolk Hackers Group With New VolkLocker Payloads Attacks both Linux and Windows Systems appeared first on Cyber Security News.