VolkLocker Ransomware Exposed by Hard-Coded Master Key Allowing Free Decryption

The Hacker News reports that VolkLocker, a ransomware offering linked to the pro-Russian hacktivist group CyberVolk (also known as GLORIAMIST), was found to suffer from hard-coded master keys, enabling free decryption. According to SentinelOne, VolkLocker (CyberVolk 2.x) emerged in August 2025 and targets both Windows and Linux, with the malware written in Golang and using AES-256 in GCM for encryption.

An analysis of test samples revealed that the master keys are embedded in the binaries and also written in plaintext to a temporary file at C:\Users\AppData\Local\Temp\system_backup.key, a design flaw that enables self-recovery since the backup file is never deleted.

The ransomware escalates privileges, enumerates drives, and deletes volume shadow copies while attempting to thwart recovery by modifying the Windows Registry and terminating Defender processes; it also enforces a 48-hour timer and can wipe user folders if decryption keys are entered incorrectly three times.

VolkLocker is sold via Telegram as a RaaS, with Windows or Linux versions priced between $800 and $1,100, or $1,600–$2,200 for both, and as of November 2025 the group advertised a remote access trojan and a keylogger for $500 each.