CyberVolk Ransomware Targets Windows Systems in Critical Infrastructure and Research Institutions

CyberVolk ransomware first emerged in May 2024 and has since escalated its operations against government agencies, critical infrastructure and scientific institutions across Japan, France and the United Kingdom. The group operates with pro-Russian leanings, focusing on states it perceives as hostile to Russian interests, and communicates threats and ransom demands via Telegram. Notable attacks include Japanese power grids, French research laboratories, and British scientific consortia.

CyberVolk uses a two-tiered symmetric encryption scheme with AES-256 GCM and ChaCha20-Poly1305, generating a single symmetric key at process initialization and applying it across target files, with a 12-byte nonce for each encryption. Post-encryption, files retain only the ciphertext and the ChaCha20-Poly1305 authentication tag, as nonces and key derivation metadata are not stored, making offline decryption unrecoverable.

The ransomware also constructs an exclusion list to avoid encryption of critical directories such as Windows, Program Files and ProgramData, and on completion creates a READMENOW.txt ransom note while prompting victims to enter a hard-coded decryption key within three attempts.