Netskope Threat Labs

HELLOKITTY

ATP Sandbox Adv. HeuristicsAV

Description

HELLOKITTY is a C++ ransomware that shares code structure and functionality with DEATHRANSOM and FIVEHANDS. Used since at least 2020, its targets have included a Polish video game developer and a Brazilian electric power company.

Stats

First seen
February 2022
Last seen
October 2026

Also known as

HelloKittyHellokitty

MITRE ATT&CK techniques

6 techniques across 3 tactics.

TA0002 Execution

  • T1047Windows Management Instrumentation

TA0007 Discovery

  • T1057Process Discovery
  • T1135Network Share Discovery
  • T1680Local Storage Discovery

TA0040 Impact

  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery

Alert name variants

Alert Name
Gen:Variant.Ransom.HelloKitty.1
Gen:Variant.Trojan.Linux.HelloKitty.1
Linux.Ransomware.HelloKitty
Win32.Ransomware.Hellokitty
Win32.Ransomware.HelloKitty
Win64.Trojan.Hellokitty

Related families

QilinBlackCatDarkGateDEATHRANSOMAkira

References