Description Summary
Unit42 states that HelloKitty is a ransomware family that first surfaced at the end of 2020, primarily targeting Windows systems. The malware family got its name due to its use of a Mutex with the same name: HelloKittyMutex. The ransomware samples seem to evolve quickly and frequently, with different versions making use of the .crypted or .kitty file extensions for encrypted files. Some newer samples make use of a Golang packer that ensures the final ransomware code is only loaded in memory, most likely to evade detection by security solutions.
Threat Actor
Closed group; notable 2021 attack on CD Projekt Red. Linux/ESXi variants; Golang packers.
Technical Indicators
Encryption Extension
.crypted / .kitty
Encryption Algorithm
AES + RSA (NTRU in some builds)
Ransom Note Name
read_me_lkdtt.txt
Targeted Industries
Cross-sector, Technology, Gaming
First Seen
Late 2020
Last Seen
Active (source code leaked 2023; Abyss Locker derived from it)
Geographical Location
Worldwide
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |