CyberVolk
CyberVolk, also known as GLORIAMIST, is a pro-Russian hacktivist group reportedly originating in India. It was first documented in 2024 and has conducted attacks aligned with Russian government interests, primarily against public and government entities and organizations it frames as opposing Russia or supporting Ukraine. Reported activity includes DDoS operations, ransomware attacks, and the use or sale of additional tooling such as infostealers, webshells, RATs, and keyloggers. CyberVolk launched a ransomware-as-a-service operation in June 2024 and later resurfaced in August 2025 with a new RaaS offering called VolkLocker, also referred to as CyberVolk 2.x. VolkLocker is a Golang-based cross-platform ransomware targeting Windows and Linux systems and is managed heavily through Telegram for payload building, command-and-control, victim management, and affiliate operations. Reported capabilities include privilege escalation via the ms-settings UAC bypass, environmental discovery, VM and sandbox checks, drive enumeration, registry modification, deletion of volume shadow copies, and termination of security or analysis-related processes. The ransomware uses AES-256-GCM for file encryption and supports configurable file extensions and timers. Multiple reports state that VolkLocker suffers from a critical implementation flaw: the master encryption key is hard-coded in the binary and also written in plaintext to %TEMP%\system_backup.key, allowing victims in some cases to recover files without paying. Reporting also describes this as likely caused by leftover test artifacts or poor quality control. Earlier CyberVolk ransomware activity was also reported to contain embedded decryption keys in code. SentinelOne reporting further states that CyberVolk has reused, tweaked, and rebranded leaked ransomware source code, including code derived from AzzaSec, and has promoted or aligned with other ransomware families including Doubleface/Invisible, HexaLocker, and Parano. CyberVolk has been described as a pro-Kremlin or pro-Russia hacktivist persona rather than a purely profit-driven ransomware crew, although it operates ransomware and affiliate services commercially. Its infrastructure and operations were reportedly disrupted by Telegram enforcement actions in late 2024 and 2025, after which it reestablished operations and expanded its offerings.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
12 malware families attributed to this actor across reporting.
7 additional families tracked in Mallory.
Observables
30 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pro-Russian hacktivist collective that deployed ransomware but made a critical implementation error by embedding decryption keys in the code, allowing victims to recover data without paying.
Pro-Russian hacktivist crew that launched a ransomware service but made implementation mistakes by hardcoding master keys into executables, enabling victim recovery without payment.
Pro-Russian hacktivist group operating a ransomware-as-a-service offering (VolkLocker) with noted cryptographic/implementation weaknesses enabling free decryption.
A pro-Russian hacktivist collective known for reusing and rebranding leaked ransomware code, recently active with VolkLocker.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.