Hellokitty is a ransomware group active since 2020, known for encrypting files with .crypted and .kitty extensions.
Analyst brief
Hellokitty is a ransomware cybercrime group active since late 2020. They primarily target Windows systems. Their key TTPs include using .crypted or .kitty extensions for encrypted files, and employing a Golang packer to load the final payload only in memory for evasion. Defenders should monitor for unusual file extensions and strengthen behavior-based detection for in-memory execution of suspicious processes.
hellokitty
crime
Unit42 states that HelloKitty is a ransomware family that first surfaced at the end of 2020, primarily targeting Windows systems. The malware family got its name due to its use of a Mutex with the same name: HelloKittyMutex. The ransomware samples seem to evolve quickly and frequently, with different versions making use of the .crypted or .kitty file extensions for encrypted files. Some newer samples make use of a Golang packer that ensures the final ransomware code is only loaded in memory, most likely to evade detection by security solutions.