HelloGookie is a rebranded HelloKitty ransomware group known for double extortion TTPs.
HelloGookie is a rebrand of the HelloKitty ransomware group, active since 2020 and announced in April 2024, known for leaking stolen data from CD Projekt Red and Cisco. It targets large corporations, employing double extortion TTPs—exfiltrating sensitive data before encrypting systems. Defenders should prioritize monitoring for compromised credentials and enforcing network segmentation to mitigate lateral movement.
HelloGookie is a rebrand of the HelloKitty ransomware group announced in April 2024, releasing previously stolen data from CD Projekt Red and Cisco; HelloKitty/HelloGookie has been active since 2020 with its highest-profile attack being the 2021 breach of CD Projekt Red.
HelloGookie employs double extortion TTPs, exfiltrating sensitive data before encrypting systems.
Defenders should prioritize monitoring for compromised credentials and enforcing network segmentation to mitigate lateral movement.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.