Hellokitty

How Hellokitty typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via HELLOKITTY.

1. T1047 Windows Management Instrumentation Execution

   What they do: HELLOKITTY can use WMI to delete volume shadow copies.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

2. T1057 Process Discovery Discovery

   What they do: HELLOKITTY can search for specific processes to terminate.

   What that means: Adversaries may attempt to get information about running processes on a system.

3. T1135 Network Share Discovery Discovery

   What they do: HELLOKITTY has the ability to enumerate network resources.

   What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

4. T1680 Local Storage Discovery Discovery

   What they do: HELLOKITTY can enumerate logical drives on a target system.

   What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

5. T1486 Data Encrypted for Impact Impact

   What they do: HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

6. T1490 Inhibit System Recovery Impact

   What they do: HELLOKITTY can delete volume shadow copies on compromised hosts.

   What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

The note this group leaves on a compromised machine. Click a filename to read it.

Hello [snip],
Unfortunately, your files were encrypted, and more than 200 GB of your critical date was leaked from your File, DEV and SQL servers (Administration and Finance, Direzione, Legal, HR, Risorse umane).
For a more detailed list of documents, please contact us and we will send you the samples we have.
We are also ready to help you recover your files, prevent the spread of leaks,
as well as help solve problems in your IT infrastructure that were the cause of the current situation, so that this does not happen again in the future.
Just contact support using the following methods and we will decrypt one non-important file for free to convince you of our honesty.
Contact us method below:
Use TOR Browser: http://gunyhng6pabzcurl7ipx2pbmjxpvqnu6mxf2h3vdeenam34inj4ndryd.onion/[snip]

************************************************

[binary_data]

Ransom-note text from RansomLook, licensed CC BY 4.0.