Famous Russian cybercriminals return with new ransomware

• CyberVolk has resurfaced with a revamped ransomware-as-a-service model, but its encryptor is fundamentally flawed
• VolkLocker’s hardcoded encryption key allows victims to recover data for free, compromising the operation
• The Group operates entirely via Telegram and combines hacktivism and financially motivated ransomware activity.

CyberVolk, a Russian hacktivist group dormant for most of 2025, is back, offering an updated version of its RaaS model to its affiliates. However, there appears to be a gaping structural hole in the cipher that renders the entire model harmless.

CyberVolk is a relatively young pro-Russian hacktivist collective that emerged in 2024. The group’s entire infrastructure is on Telegram, making it a simple process for affiliates to lock files and demand a ransom, even if they aren’t very tech-savvy.