Loading malware…
PartyTicket, also known as HermeticRansom, is a Go-based ransomware family deployed against organizations in Ukraine in February 2022 alongside the destructive wiper HermeticWiper. It is widely assessed to have functioned primarily as a decoy intended to distract responders and victims from the underlying destructive operation, echoing earlier pseudo-ransomware tradecraft seen in attacks on Ukraine. Reporting links its use to the broader Russia-Ukraine conflict and to intrusion activity affecting Ukrainian government, critical infrastructure, and other organizations, with Sandworm/APT44 frequently discussed in the surrounding campaign context.
PartyTicket runs in the context of the current user and enumerates local drives and files for encryption, skipping some system-related directories while targeting a broad set of file types. It encrypts files with AES-GCM and uses an embedded RSA public key to protect per-file AES material, then drops a ransom note and renames encrypted files with a distinctive appended extension. The malware also creates multiple self-copies and launches child processes to encrypt files in parallel, a noisy and inefficient design that can significantly degrade system performance.
Technical analysis has characterized PartyTicket as rushed and poorly implemented compared with mature ransomware operations. Its AES key generation relies on Go's deterministic math/rand rather than a cryptographically secure source, weakening the encryption design and making recovery more feasible than intended. It also lacks common ransomware operational features such as robust handling of locked files or process termination for business applications and databases. These shortcomings, combined with its concurrent deployment with HermeticWiper, support the assessment that PartyTicket was not the primary destructive mechanism but a diversionary ransomware component within a broader disruptive campaign targeting Windows systems in Ukraine.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
The function at __C__projects_403forBiden_wHiteHousE_init checks if the OS supports AVX ... and is also responsible for ... getting the time zone data.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A poorly coded Go-based ransomware used as a decoy alongside HermeticWiper. It recursively enumerates folders, spawns excessive concurrent threads, copies files to UUID-named .exe files, deletes originals, and appears intended to encrypt files with AES, though its flawed design mainly hogs system resources and generates noise.
Decoy ransomware dropped alongside HermeticWiper. It encrypts selected file types using AES-GCM with an RSA public key wrapper, writes a ransom note, appends a distinctive extension, and slows the infected system by spawning many duplicate encryptor processes; the implementation is flawed and not considered sophisticated.
Ransomware used as a decoy alongside HermeticWiper to distract from the underlying destructive wiper attack.
Golang-based ransomware reportedly deployed alongside HermeticWiper. It encrypts files across available drives using RSA and AES, appends the extension .[vote2024forjb@protonmail.com].encryptedJB, and drops a ransom note as read_me.html.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.