VolkLocker

VolkLocker

VolkLocker is a ransomware family first reported in 2025 by several cybersecurity news outlets and security vendors. Reporting by The Hacker News and SentinelOne linked the malware to the pro-Russian hacktivist group known as CyberVolk, which has previously carried out denial-of-service attacks and other politically motivated activity. The group is also tracked by some researchers under the name GLORIAMIST.

The ransomware targets Microsoft Windows and Linux systems and is distributed through a ransomware-as-a-service model. Coverage of VolkLocker focused largely on a design flaw that allows encrypted data to be recovered without paying a ransom in some cases.

Background

VolkLocker began receiving attention in August 2025 after samples were shared among security researchers and analyzed by multiple firms. SentinelOne reported that the malware was promoted through Telegram channels operated by CyberVolk, where affiliates could generate customized ransomware builds by supplying configuration details such as payment addresses and execution parameters.

According to The Register, the appearance of VolkLocker marked a shift by CyberVolk toward financially motivated activity, following earlier campaigns that focused primarily on disruption rather than extortion.

Technical characteristics

Analysis published by SentinelOne described VolkLocker as being written in the Go programming language, allowing it to run on both Windows and Linux platforms. The malware performs basic system checks before encrypting files on the local system.

BleepingComputer reported that VolkLocker uses AES-256 encryption in Galois/Counter Mode (GCM) and appends new file extensions to affected files. Some variants were also observed attempting to remove backup copies, although this behavior was not consistent across all samples.

Encryption flaw

Multiple reports noted that VolkLocker contains a critical implementation error. The Hacker News documented that the ransomware relies on a hard-coded encryption key embedded directly in the malware binary, rather than generating unique keys for each victim. In addition, the same key was written to a plaintext file on disk during execution.

As a result, victims who were able to locate the key file could potentially recover encrypted data without contacting the attackers or paying a ransom, reducing the effectiveness of the extortion scheme.

Distribution and operation

Reporting by The Register and The Hacker News described VolkLocker as being offered through a ransomware-as-a-service program operated on Telegram. Affiliates were able to generate customized payloads and were charged different fees depending on the targeted operating system.

The Hacker News reported that CyberVolk later advertised additional malicious tools alongside VolkLocker, including remote access trojans and keylogging software, suggesting a broader expansion of the group’s criminal activity beyond ransomware alone.

Impact

Although VolkLocker was capable of encrypting files and disrupting infected systems, security researchers noted that its cryptographic weakness significantly limited its impact compared to more established ransomware families. BleepingComputer described the malware as an example of poorly implemented ransomware that nevertheless caused operational disruption during incidents.

TechRadar characterized VolkLocker as part of a broader trend in which politically aligned groups experiment with ransomware operations despite limited technical sophistication.

See also

• Ransomware-as-a-service
• Advanced Encryption Standard

References

This article "VolkLocker" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:VolkLocker. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

📰 Article(s) of the same category(ies)

• DSploit
• ZVZ
• Adam Palmer
• Computer security
• Santrex
• MaskPark
• Mira Malware

---