VOLKLOCKER RANSOMWARE EXPOSED BY HARD-CODED MASTER KEY ALLOWING FREE DECRYPTION

Summary from the TLDR InfoSec newsletter

Pro-Russian hacktivist group CyberVolk's new VolkLocker ransomware-as-a-service contains a critical implementation flaw that hard-codes AES-256 master keys in binaries and writes them to a plaintext file in the %TEMP% folder, enabling free decryption without paying the ransom. The Golang-based malware targets Windows and Linux systems, featuring privilege escalation, VM detection, shadow copy deletion, and a 48-hour enforcement timer that wipes user folders if payment isn't made. Victims should check for the system_backup.key file in their Temp directory before considering a ransom payment, as this oversight renders the $800-$2,200 RaaS offering ineffective for attackers.