Hello Kitty

Hello Kitty, also referred to as FiveHands, is a ransomware family first publicly observed in 2021 and used in double-extortion intrusions. Operators associated with Hello Kitty/FiveHands typically steal data before encrypting systems and threaten public release or sale of the stolen information if victims do not pay. In some cases, the extortion pressure has reportedly been escalated with disruptive attacks against victims’ public-facing websites. The malware has been linked to high-profile enterprise compromises, including the attack on CD Projekt, where source code and internal documents were stolen.

Intrusions involving Hello Kitty/FiveHands have used compromised credentials and exploitation of internet-facing systems, including SonicWall vulnerabilities, for initial access. Post-compromise activity has included use of common offensive tooling for network mapping, privilege escalation, credential access, and lateral movement, such as Cobalt Strike, PowerShell Empire, BloodHound, Mimikatz, and remote administration utilities. Exfiltration commonly precedes encryption, consistent with modern ransomware tradecraft.

Hello Kitty has also appeared as a third-party payload used by other threat actors rather than exclusively by a single dedicated group. Vice Society in particular has been repeatedly reported deploying Hello Kitty/FiveHands alongside other ransomware families such as Zeppelin, reflecting an affiliate-style or multi-payload operational model. Reporting has also noted overlap between Hello Kitty and broader criminal ecosystems that include actors formerly associated with Conti. The malware primarily targets Windows enterprise environments and has been observed in attacks affecting sectors including education, healthcare, manufacturing, and technology, as well as other organizations selected for financially motivated extortion.