Notorious Russian cybercriminals return with new ransomware

• CyberVolk has reappeared with an updated ransomware-as-a-service model, but its encryptor is fundamentally broken
• VolkLocker's hard-coded encryption key allows victims to recover data for free, undermining the operation.
• The group operates entirely through Telegram and combines hacktivism with financially motivated ransomware distribution activities.

CyberVolk, a Russian hacktivist group that has been dormant for most of 2025, has returned, offering its affiliates an updated version of its RaaS model. However, there appears to be a gaping structural hole in the encoder that renders the entire model harmless.

CyberVolk is a relatively young pro-Russian hacktivist collective that emerged in 2024. The entire infrastructure of the group is located on Telegram, which simplifies the process of blocking files and demanding ransom for group members, even if they are not very tech-savvy.