HelloKitty Successor Kraken Ransomware Hits Windows/ESXi, Benchmarks Victim Performance Before Encryption

Cisco Talos has released analysis showing that Kraken ransomware, a successor to the HelloKitty cartel, is rapidly expanding its operations and targeting enterprise systems across Windows, Linux, and VMware ESXi environments. The threat group has already been implicated in attacks across the United States, United Kingdom, Canada, Denmark, Panama, and Kuwait, reflecting broad opportunistic targeting rather than a sector focus.

Kraken first appeared in February 2025 and uses the same extortion infrastructure style as its predecessor, including a data-leak site to disclose stolen data when ransom demands are not met. Notably, Kraken can benchmark a victim’s system performance before encryption, deciding full or partial encryption based on CPU and I/O throughput, a feature available across Windows and Linux/ESXi encryptors.

Its infection chain includes exploiting exposed SMB services, extracting administrator credentials, and establishing a persistent reverse tunnel with Cloudflared, then exfiltrating data via SSHFS before decrypting files with a .zpsc extension and a ransom note named readme_you_ws_hacked.txt. The campaign demonstrates cross-platform versatility and the aim to build an underground ecosystem around Kraken.