Tag: chacha20-poly1305

3 Attack Reports | 0 Vulnerabilities

Attack reports

Analysis of Encryption Structure of Yurei Ransomware Go-based Builder

The Yurei ransomware group, first identified in September 2025, employs a typical ransomware operation model targeting corporate networks. Their attacks have affected Sri Lanka and Nigeria, focusing on transportation, IT, marketing, and food industries. The ransomware, developed in Go, uses ChaCha2…
ransomware
encryption
chacha20-poly1305
go-based
yurei
2025-11-14
darkweb
secp256k1-ecies
corporate networks
Published: November 14, 2025
Downloadable IOCs: 1

CyberVolk Ransomware: Analysis of Double Encryption Structure and Disguised Decryption Logic

The CyberVolk ransomware, emerging in May 2024, targets public institutions and key infrastructures of anti-Russian countries. It uses a double encryption structure with AES-256 GCM and ChaCha20-Poly1305 algorithms. The ransomware excludes certain files and directories from encryption and uses a sy…
ransomware
geopolitical
pro-russian
chacha20-poly1305
2025-09-12
symmetric key
cybervolk
aes-256 gcm
double encryption
Published: September 12, 2025
Downloadable IOCs: 0

Tracking GLOBAL GROUP Ransomware from Mamona to Market Scale

A new ransomware actor, GLOBAL GROUP, emerged on the Ramp4u cybercrime forum in June 2025, claiming to offer a fresh Ransomware-as-a-Service (RaaS) platform. However, forensic evidence reveals that GLOBAL is a rebranded continuation of the Mamona RIP and Black Lock ransomware families. The ransomwa…
ransomware
golang
cross-platform
raas
tor
initial access brokers
black lock
2025-08-21
chacha20-poly1305
mamona rip
global group
ai chatbot
Published: August 21, 2025
Linked vulnerabilities : CVE-2024-57727 (CVSS 7.5), CVE-2025-22457 (CVSS 9.0), CVE-2025-32433 (CVSS 10.0), CVE-2025-31324 (CVSS 10.0)
Downloadable IOCs: 6
Click here to see more Attack Reports