SOC Prime Bias: High

12 Dec 2025 17:56
newspaper icon SentinelOne

CyberVolk Reemerges: VolkLocker’s New Features and Flaws

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
CyberVolk Reemerges: VolkLocker’s New Features and Flaws
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

The article covers the resurgence of the pro-Russia hacktivist collective CyberVolk and its new ransomware family dubbed VolkLocker. This Golang-based ransomware targets both Windows and Linux systems and relies on Telegram for command and control. It uses a hard-coded AES-256-GCM master key, which is also written in plaintext to the %TEMP% directory, effectively creating an unintended decryption shortcut. VolkLocker further tampers with registry settings, turns off security controls, and attempts destructive actions against the system once a built-in timer expires.

Investigation

Researchers examined the VolkLocker sample and observed that it is distributed without code obfuscation, instead recommending the use of UPX for packing. The ransomware carries out environment checks, enumerates available drives, encrypts data using a static master key, and stores that key in a hidden backup file. Persistence is maintained by replicating the executable into multiple paths and applying registry changes. Telegram bot tokens and a Bitcoin address are mandatory configuration elements for successful operation.

Mitigation

Defenders should watch for the documented registry changes, the creation of the plaintext key backup file, and multiple copies of the same executable appearing in startup locations. Blocking outbound traffic to Telegram-related domains and flagging UPX-packed binaries can help limit risk. Maintaining regular offline or immutable backups and preventing automatic deletion of volume shadow copies are also advised.

Response

After detection, immediately isolate the compromised endpoint, retrieve the plaintext key backup file from %TEMP%, and leverage the known master key for file decryption. Eradicate all instances of the VolkLocker executable, restore altered registry values, and restart any disabled security solutions. Perform a forensic review of Telegram-based C2 traffic and continue monitoring for subsequent misuse of the exposed bot token.

graph TB %% Class definitions classDef technique fill:#99ccff classDef malware fill:#ffcc99 classDef tool fill:#cccccc classDef file fill:#e6e6e6 classDef operator fill:#ff9900 %% Privilege Escalation tech_pe_bypass_uac[“<b>Technique</b> – <b>T1548.002 Bypass User Account Control</b><br/><b>Description</b>: Hijacks HKCU\\Software\\Classes\\ms-settings\\shell\\open\\command to gain elevated rights”] class tech_pe_bypass_uac technique %% Persistence tech_persistence_rc[“<b>Technique</b> – <b>T1037.004 Boot or Logon Initialization Scripts: RC Scripts</b><br/><b>Description</b>: Copies payload to startup locations”] class tech_persistence_rc technique tech_persistence_startup[“<b>Technique</b> – <b>T1037.005 Startup Items</b><br/><b>Description</b>: Places cvolk.exe in user Startup folder”] class tech_persistence_startup technique tech_persistence_active[“<b>Technique</b> – <b>T1547.014 Active Setup</b><br/><b>Description</b>: Registers Active Setup entries for persistence”] class tech_persistence_active technique file_cvolk[“<b>File</b> – cvolk.exe<br/>Path: %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup”] class file_cvolk file file_svchost[“<b>File</b> – svchost.exe<br/>Path: %PUBLIC%\\Documents”] class file_svchost file file_wlanext[“<b>File</b> – wlanext.exe<br/>Path: %SYSTEMDRIVE%\\ProgramData\\Microsoft\\Network”] class file_wlanext file file_windowsupdate[“<b>File</b> – WindowsUpdate.exe<br/>Path: %TEMP%”] class file_windowsupdate file %% Defense Evasion tech_account_removal[“<b>Technique</b> – <b>T1531 Account Access Removal</b><br/><b>Description</b>: Disables user accounts and tools”] class tech_account_removal technique tech_exclusive_control[“<b>Technique</b> – <b>T1668 Exclusive Control</b><br/><b>Description</b>: Modifies registry to block Task Manager, CMD, Defender”] class tech_exclusive_control technique tech_impair_defenses[“<b>Technique</b> – <b>T1562.010 Disable or Modify Security Tools</b><br/><b>Description</b>: Turns off real‑time monitoring”] class tech_impair_defenses technique %% Virtualization Evasion tech_vm_check[“<b>Technique</b> – <b>T1497.002 User Activity Based Checks</b><br/><b>Description</b>: Checks MAC prefixes and VM registry keys”] class tech_vm_check technique %% File Encryption tech_custom_archive[“<b>Technique</b> – <b>T1560.003 Archive via Custom Method</b><br/><b>Description</b>: Encrypts files with AES‑256‑GCM using hard‑coded master key”] class tech_custom_archive technique tech_upx_packing[“<b>Technique</b> – <b>T1027.015 Obfuscated/Compressed Files: UPX</b><br/><b>Description</b>: Packs binaries with UPX”] class tech_upx_packing technique %% Key Backup file_key_backup[“<b>File</b> – system_backup.key<br/>Location: %TEMP%<br/><b>Issue</b>: Stores master key in plaintext”] class file_key_backup file %% Inhibit System Recovery tech_vss_delete[“<b>Technique</b> – <b>T1490 Inhibit System Recovery</b><br/><b>Description</b>: Deletes all Volume Shadow Copies via vssadmin”] class tech_vss_delete technique %% Data Destruction tech_disk_wipe[“<b>Technique</b> – <b>T1561.001 Disk Content Wipe: Files</b><br/><b>Description</b>: Wipes Documents, Desktop, Downloads, Pictures”] class tech_disk_wipe technique tech_bsod[“<b>Technique</b> – <b>T1499.004 Endpoint Denial of Service: Application Exploitation</b><br/><b>Description</b>: Triggers BSOD using NtRaiseHardError”] class tech_bsod technique %% Command and Control tech_c2_telegram[“<b>Technique</b> – <b>T1102.002 Web Service: Bidirectional Communication</b><br/><b>Description</b>: Uses Telegram bot for C2, dynamic resolution”] class tech_c2_telegram technique %% Indicator Removal tech_file_deletion[“<b>Technique</b> – <b>T1070.004 File Deletion</b><br/><b>Description</b>: Deletes temporary files and sets hidden/system attributes”] class tech_file_deletion technique %% Flow connections tech_pe_bypass_uac –>|enables| tech_persistence_rc tech_persistence_rc –>|copies| file_cvolk tech_persistence_rc –>|copies| file_svchost tech_persistence_rc –>|copies| file_wlanext tech_persistence_rc –>|copies| file_windowsupdate tech_persistence_rc –>|creates| tech_persistence_startup tech_persistence_rc –>|creates| tech_persistence_active tech_persistence_startup –>|places| file_cvolk tech_persistence_active –>|registers| file_cvolk tech_persistence_rc –>|leads_to| tech_account_removal tech_account_removal –>|modifies| tech_exclusive_control tech_exclusive_control –>|disables| tech_impair_defenses tech_impair_defenses –>|prepares| tech_vm_check tech_vm_check –>|bypasses| tech_custom_archive tech_custom_archive –>|uses| tech_upx_packing tech_upx_packing –>|produces| file_cvolk tech_custom_archive –>|writes| file_key_backup tech_custom_archive –>|triggers| tech_vss_delete tech_vss_delete –>|prevents recovery for| tech_disk_wipe tech_disk_wipe –>|followed by| tech_bsod tech_bsod –>|signals| tech_c2_telegram tech_c2_telegram –>|reports| tech_file_deletion tech_file_deletion –>|removes| file_key_backup %% Styling class tech_pe_bypass_uac,tech_persistence_rc,tech_persistence_startup,tech_persistence_active,tech_account_removal,tech_exclusive_control,tech_impair_defenses,tech_vm_check,tech_custom_archive,tech_upx_packing,tech_vss_delete,tech_disk_wipe,tech_bsod,tech_c2_telegram,tech_file_deletion technique class file_cvolk,file_svchost,file_wlanext,file_windowsupdate,file_key_backup file

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

  • Attack Narrative & Commands:

    1. Objective: Obtain SYSTEM privileges on a standard user workstation while evading security tooling.
    2. Step 1 – UAC Bypass: The attacker launches ms-settings.exe with a command line that forces the process to call NtRaiseHardError, a known undocumented API that can trigger a UAC elevation prompt that can be auto‑accepted in certain mis‑configurations.
    3. Step 2 – Disrupt Defenses: Immediately after the elevation, the same command line invokes taskkill.exe to terminate known analysis tools (procmon.exe, processhacker.exe, etc.) that might be monitoring privileged processes.
    4. Resulting Telemetry: A single process‑creation event where Image = ms-settings.exe and CommandLine contains both taskkill.exe and NtRaiseHardError, satisfying the Sigma rule’s selection.
    # Combined malicious command – crafted to appear as ms-settings.exe arguments
$maliciousCmd = '"C:\Windows\System32\ms-settings.exe" "taskkill.exe /F /IM procmon.exe" "NtRaiseHardError"'
Start-Process -FilePath "$env:SystemRoot\system32\ms-settings.exe" -ArgumentList $maliciousCmd

  • Regression Test Script: The following PowerShell script reproduces the exact attack and can be reused for automated regression testing.

    <#
.SYNOPSIS
    Simulates the CyberVolk ms‑settings UAC bypass + analysis‑tool termination technique.
.DESCRIPTION
    Launches ms-settings.exe with a crafted argument list that includes taskkill.exe and NtRaiseHardError.
    Generates the specific process‑creation telemetry required to fire the Sigma detection rule.
.NOTES
    Run with a normal user account. Ensure that the target environment has process‑creation logging enabled.
#>

# Parameters (adjust if needed)
$msSettings = "$env:SystemRoot\system32\ms-settings.exe"
$analysisTools = @("procmon.exe","processhacker.exe","ida64.exe")
$killCmd = "taskkill.exe /F /IM " + ($analysisTools -join " /IM ")
$hardError = "NtRaiseHardError"

# Build the malicious argument string
$argList = @($killCmd, $hardError) -join " "

Write-Host "Launching ms-settings.exe with malicious arguments..."
Start-Process -FilePath $msSettings -ArgumentList $argList

Write-Host "Command executed:"
Write-Host "`"$msSettings`" $argList"

  • Cleanup Commands: After verification, terminate any lingering ms-settings.exe processes and restore normal system state.

    # Stop any ms-settings processes that may still be running
Get-Process -Name "ms-settings" -ErrorAction SilentlyContinue | Stop-Process -Force

# Optional: Verify no analysis tools were unintentionally killed
foreach ($tool in @("procmon","processhacker","ida64")) {
    if (Get-Process -Name $tool -ErrorAction SilentlyContinue) {
        Write-Host "$tool is still running."
    } else {
        Write-Host "$tool was terminated (expected for the test)."
    }
}

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free