CyberVolk Ransomware’s Decryption Flaw Makes Data Recovery Impossible

The CyberVolk ransomware has been actively targeting public institutions and critical infrastructure since May 2024, according to AhnLab, which notes its geopolitical motivation and the resulting unrecoverable encryption design. The analysis describes a layered encryption approach that begins with AES-256 in GCM mode and is followed by ChaCha20-Poly1305, with a 12‑byte nonce generated during encryption.

A critical flaw occurs in the decryption routine: the correct Nonce value must be used, but an incorrect one is applied, causing decryption to fail, and the nonce is never stored, making file recovery mathematically impossible even with the right key. The malware restarts with administrator rights and avoids encrypting certain directories, such as Program Files and ProgramData, while excluding already encrypted files with the .CyberVolk extension.

After encryption, a READMENOW.txt ransom note is dropped, warning victims and offering three attempts to enter a decryption key, though the analysis states that correct keys do not yield successful decryption. The group has claimed attacks on infrastructure and scientific institutions in Japan, France, and the UK, and is described as having a pro-Russian stance. 11 September 2025.