FBI: HelloKitty ransomware adds DDoS attacks to extortion tactics

The U.S. Federal Bureau of Investigation (FBI) has sent out a flash alert warning private industry partners that the HelloKitty ransomware gang (aka FiveHands) has added distributed denial-of-service (DDoS) attacks to their arsenal of extortion tactics.

In a Friday notification coordinated with the Cybersecurity and Infrastructure Security Agency (CISA), the FBI said that the ransomware group would take their victims' official websites down in DDoS attacks if they didn't comply with the ransom demands.

HelloKitty is also known for stealing sensitive documents from victims' compromised servers before encrypting them. The exfiltrated files are later used as leverage to pressure the victims into paying the ransom under the threat of leaking the stolen data online on a data leak site.

"In some cases, if the victim does not respond quickly or does not pay the ransom, the threat actors will launch a Distributed Denial of Service (DDoS) attack on the victim company's public facing website," the FBI said.

"Hello Kitty/FiveHands actors demand varying ransom payments in Bitcoin (BTC) that appear tailored to each victim, commensurate with their assessed ability to pay it. If no ransom is paid, the threat actors will post victim data to the Babuk site payload.bin) or sell it to a third-party data broker."

The group's ransomware operators will use several methods to breach the targets' networks, including compromised credentials and recently patched security flaws in SonicWall products (e.g., CVE-2021-20016, CVE-2021-20021, CVE-2021-20022, CVE-2021-2002).

Who is HelloKitty?

HelloKity is a human-operated ransomware operation active since November 2020 and first observed by the FBI in January 2021.

The gang is mainly known for breaching and encrypting the systems of CD Projekt Red in February and claiming to have stolen Cyberpunk 2077, Witcher 3, Gwent, and other games' source code.

HelloKitty later claimed that someone had purchased the files stolen from CD Projekt Red although it was never confirmed.

Since at least July 2021, the ransomware gang was also observed using a Linux variant that targets VMware's ESXi virtual machine platform.

They're just one of the multiple ransomware gangs targeting Linux servers after enterprise targets have migrated to using virtual machines for more efficient use of resources and easier device management.

By targeting their virtual machines, ransomware operators can now encrypt multiple servers simultaneously, with a single command, saving time and effort.

Based on submissions made by their victims on the ID Ransomware platform, HelloKitty significantly increased its activity in July and August, immediately after starting to use the Linux variant in attacks.

The HelloKitty ransomware or its variants have also been used under other names including DeathRansom and Fivehands.

The FBI also shared an extensive collection of indicators of compromise (IOCs) in their alert to help cybersecurity professionals and system admins to guard against attack attempts coordinated by the HelloKitty ransomware gang.