Notorious Russian cybercriminals return with new ransomware

• CyberVolk resurfaced with a revamped ransomware‑as‑a‑service model but its encryptor is fundamentally broken
• VolkLocker’s hardcoded encryption key lets victims recover data for free, undermining the operation
• The Group operates entirely via Telegram and blends hacktivism with financially motivated ransomware activity

CyberVolk, a Russian hacktivist group that’s been dormant for most of 2025 is back, offering an updated version of its RaaS model to its affiliates. However, there seems to be a gaping structural hole in the encryptor that renders the entire model harmless.

CyberVolk is a relatively young, pro-Russian hacktivist collective that emerged in 2024.The group’s entire infrastructure is on Telegram, making it a simple process for affiliates to lock files and demand ransom, even if they aren’t too tech-savvy.