Flaw in Hacktivist Ransomware Lets Victims Decrypt Own Files

A new version of VolkLocker, the ransomware‑as‑a‑service offering of CyberVolk, has surfaced with enhancements but a fatal flaw that could let victims decrypt their own files, according to SentinelOne. The pro‑Russia hacktivist group is described as expanding its RaaS tools, including Telegram automation for end‑to‑end C2 communications, while the operation reportedly struggles with expansion.

The key flaw lies in how the ransomware handles encryption keys: instead of generating dynamic keys, it uses a single master key stored as plaintext in a backup file within the %TEMP% folder, creating a decryption pathway for victims who discover it, Walter noted. This backup key file is believed to be a test artifact that shipped with some builds, and operators may be unaware affiliates are deploying with the flaw.

SentinelOne’s researchers warn that the design flaw persists in the backupMasterKey() function, undermining the malware’s effectiveness by enabling victims to recover files without paying a ransom. The article also notes that VolkLocker is the evolution of CyberVolk’s ransomware, with additional products and an updated pricing model.

According to SentinelOne, the revival comes despite Telegram bans and channel removals in 2025, and the IoCs and a Bitcoin address linked to ransom payments were published to aid defenders.