Threat Profile: VolkLocker

VolkLocker (also tracked as CyberVolk 2.x) is a Golang-based Ransomware-as-a-Service (RaaS) platform operated by the pro-Russian/Indian hacktivist collective CyberVolk. While the group markets sophisticated Telegram-based automation, the malware itself suffers from critical cryptographic implementation flaws.

Malware Analysis & Flaws

1. Cryptographic Failure (Free Decryption)

• Algorithm: AES-256-GCM using Golang’s crypto/rand package for nonce generation.
• Critical Vulnerability: The Master Key is hardcoded in the binary as a hex string. Furthermore, during execution, the malware writes the decryption key in plaintext to a backup file on the victim’s disk.
  • Key Path: %TEMP%\system_backup.key
  • File Content: Format includes User: CV<ID> Key: <64-char-Master-Key>.
• Impact: Victims can recover files by locating this key file or extracting the hardcoded key from the binary, rendering the ransom demand void.

2. Destructive Capabilities

VolkLocker includes a “wiper” component designed to punish non-payment:

• Timer: A 48-hour countdown is managed via Golang’s time.After() function.
• Trigger: If the timer expires or an incorrect key is entered 3 times, the malware executes a DestroySystem() function.
• Action: Recursively deletes files in Documents, Desktop, Downloads, and Pictures.

3. Privilege Escalation (UAC Bypass)

The malware bypasses User Account Control (UAC) using the mock folders / ms-settings technique:

• Registry Key: HKCU\Software\Classes\ms-settings\shell\open\command
• Command: Sets the DelegateExecute value to launch the malware with elevated privileges silently.

Indicators of Compromise (IOCs)

File Artifacts

• Extensions: .locked, .cvolk
• Plaintext Key File: %TEMP%\system_backup.key (Save this file immediately!).
• Ransom Note: cybervolk_ransom.html (Dynamic HTML application).
• Persistence:
  • %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\cvolk.exe
  • %PUBLIC%\Documents\svchost.exe (Masquerading as system process)

Network Indicators

• C2: Traffic to api.telegram.org (Telegram Bot API) containing victim system info (Hostname, IP, OS).