Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian Targets via Exchange/SharePoint Exploitation

Key facts for Hacking Cat ransomware attacks

Detection coverage for Hacking Cat ransomware attacks

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2515 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Gorilla RAT / Monkey Ransomware / Nemo Wiper Persistence & Destructive Preparation — SPL Primary

Detects the post-exploitation kill-chain Hacking Cat tooling executes on compromised hosts: VSS shadow-copy deletion, Windows Event Log clearing, Windows Defender exclusion additions, Registry Run Key persistence from AppData\Local (Gorilla RAT), SYSTEM-level scheduled task creation, a forced reboot into Safe Mode with Networking (Nemo Wiper's LSAPlatformUpdate.ps1 delivery chain), malicious network-provider service creation (nplsvc.exe), and execution of known Hacking Cat malware hashes (Gorilla RAT, Monkey Ransomware variants, ClearWater, Nemo Wiper, plus community-corroborated sibling hashes from OSINT).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1490, T1070.001, T1562.001, T1547.001, T1053.005, T1529, T1543.003
• Data sources: sysmon, windows_security_eventlog, windows_powershell_operational, microsoft_defender_atp_deviceprocessevents, microsoft_defender_atp_deviceregistryevents, microsoft_defender_atp_devicefileevents
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon OR index=wineventlog OR index=powershell sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","WinEventLog:Security","WinEventLog:Microsoft-Windows-PowerShell/Operational")
| eval is_vssadmin=if(match(CommandLine, "(?i)vssadmin.*(delete|resize).*shadows"), 1, 0)
| eval is_evtlog_clear=if(EventCode=1102 OR match(CommandLine, "(?i)wevtutil.*(cl |clear-log)"), 1, 0)
| eval is_defender_exclusion=if(match(CommandLine, "(?i)Add-MpPreference.*Exclusion"), 1, 0)
| eval is_runkey_persist=if(EventCode=13 AND match(TargetObject, "(?i)\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run") AND match(Image, "(?i)\\\\Users\\\\.*\\\\AppData\\\\Local\\\\"), 1, 0)
| eval is_schtasks_system=if(match(CommandLine, "(?i)schtasks.*\/create") AND match(CommandLine, "(?i)\/ru\s+system"), 1, 0)
| eval is_safemode_reboot=if(match(CommandLine, "(?i)bcdedit.*safeboot.*network"), 1, 0)
| eval is_netprovider_service=if(match(CommandLine, "(?i)(sc(\.exe)?\s+create|New-Service).*(nplsvc|network.?provider)"), 1, 0)
| eval is_usbstor_disable=if(EventCode=13 AND match(TargetObject, "(?i)CurrentControlSet\\\\Services\\\\USBSTOR\\\\Start"), 1, 0)
| eval is_known_malware_hash=if(match(Hashes, "(?i)(2EF4FF20CA73F738ED34AE35E700C5FF|FD71C1C84954BF51837BF362945AED8E|E28C75F68F337B23C2306EFE83756B50|CF4840AE85D7ACBA4974D6DD55893D6C|583FCADF646610BBAC86ADDDDEE75AE0|257DE0E2744C99A12CBC1C1B37C76E0E8A010DDE3125EC09468A16E4F8E0F121|647F968D18620D7D69FE51E67A7F2F83DDC8551716472D4468197E2DC8130A94|36CCDC537914FC9375EBAC92C660A8D4|F711847ABFF31937CEBEB23C5D8CDC58)"), 1, 0)
| where is_vssadmin=1 OR is_evtlog_clear=1 OR is_defender_exclusion=1 OR is_runkey_persist=1 OR is_schtasks_system=1 OR is_safemode_reboot=1 OR is_netprovider_service=1 OR is_usbstor_disable=1 OR is_known_malware_hash=1
| eval behavior=case(is_vssadmin=1,"VSS Shadow Copy Deletion (T1490)", is_evtlog_clear=1,"Windows Event Log Clearing (T1070.001)", is_defender_exclusion=1,"Defender Exclusion Addition (T1562.001)", is_runkey_persist=1,"Registry Run Key Persistence (T1547.001)", is_schtasks_system=1,"SYSTEM Scheduled Task via schtasks (T1053.005)", is_safemode_reboot=1,"Forced Safe Mode w/ Networking Reboot - Nemo Wiper (T1529)", is_netprovider_service=1,"Malicious Network-Provider Service Creation - nplsvc.exe (T1543.003)", is_usbstor_disable=1,"USB Mass Storage Disabled Post-Destruction (Nemo Wiper)", is_known_malware_hash=1,"Known Hacking Cat Malware Hash Execution")
| stats count min(_time) as first_seen values(CommandLine) as commands by Computer, User, behavior
| where count >= 1

Microsoft KQL

let KnownHashes = dynamic(["2EF4FF20CA73F738ED34AE35E700C5FF","FD71C1C84954BF51837BF362945AED8E","E28C75F68F337B23C2306EFE83756B50","CF4840AE85D7ACBA4974D6DD55893D6C","583FCADF646610BBAC86ADDDDEE75AE0","257DE0E2744C99A12CBC1C1B37C76E0E8A010DDE3125EC09468A16E4F8E0F121","647F968D18620D7D69FE51E67A7F2F83DDC8551716472D4468197E2DC8130A94","36CCDC537914FC9375EBAC92C660A8D4","F711847ABFF31937CEBEB23C5D8CDC58"]);
let PostExploitEvents = union
    (DeviceProcessEvents | where TimeGenerated > ago(24h) | where ProcessCommandLine has "vssadmin" and ProcessCommandLine has_any ("delete", "resize") and ProcessCommandLine has "shadows" | extend Behavior = "VSS Shadow Copy Deletion (T1490)"),
    (DeviceProcessEvents | where TimeGenerated > ago(24h) | where ProcessCommandLine has "Add-MpPreference" and ProcessCommandLine has "Exclusion" | extend Behavior = "Defender Exclusion Addition (T1562.001)"),
    (DeviceProcessEvents | where TimeGenerated > ago(24h) | where ProcessCommandLine has "schtasks" and ProcessCommandLine has "/create" and ProcessCommandLine has "SYSTEM" | extend Behavior = "SYSTEM Scheduled Task via schtasks (T1053.005)"),
    (DeviceProcessEvents | where TimeGenerated > ago(24h) | where ProcessCommandLine has "bcdedit" and ProcessCommandLine has "safeboot" and ProcessCommandLine has "network" | extend Behavior = "Forced Safe Mode w/ Networking Reboot - Nemo Wiper (T1529)"),
    (DeviceProcessEvents | where TimeGenerated > ago(24h) | where (ProcessCommandLine has "sc create" or ProcessCommandLine has "New-Service") and (ProcessCommandLine has "nplsvc" or ProcessCommandLine has "network provider") | extend Behavior = "Malicious Network-Provider Service Creation - nplsvc.exe (T1543.003)"),
    (DeviceFileEvents | where TimeGenerated > ago(24h) | where SHA256 in (KnownHashes) or MD5 in (KnownHashes) | extend Behavior = "Known Hacking Cat Malware Hash Execution"),
    (DeviceRegistryEvents | where TimeGenerated > ago(24h) | where RegistryKey has @"Software\Microsoft\Windows\CurrentVersion\Run" and InitiatingProcessFolderPath has @"\AppData\Local\" | extend Behavior = "Registry Run Key Persistence (T1547.001)"),
    (DeviceRegistryEvents | where TimeGenerated > ago(24h) | where RegistryKey has @"CurrentControlSet\Services\USBSTOR" and RegistryValueName == "Start" | extend Behavior = "USB Mass Storage Disabled Post-Destruction (Nemo Wiper)"),
    (SecurityEvent | where TimeGenerated > ago(24h) | where EventID == 1102 | extend Behavior = "Windows Security Event Log Cleared (T1070.001)");
PostExploitEvents
| project TimeGenerated, DeviceName = coalesce(DeviceName, Computer), Account = coalesce(InitiatingProcessAccountName, AccountName), Behavior, Detail = coalesce(ProcessCommandLine, RegistryKey, SHA256, "")
| summarize Count = count(), FirstSeen = min(TimeGenerated) by DeviceName, Account, Behavior

Sigma

title: Gorilla RAT / Monkey Ransomware / Nemo Wiper Persistence & Destructive Preparation
id: c4a89e2f-1b6d-4f3a-9e7c-5a8d2f4b6c19
status: experimental
description: Detects post-exploitation behaviors used by Hacking Cat tooling - VSS shadow copy deletion, Defender exclusion additions, SYSTEM scheduled task creation, forced Safe Mode reboot, malicious network-provider service creation (Nemo Wiper nplsvc.exe), and execution of known Hacking Cat malware hashes.
references:
  - https://therecord.media/ukraine-malware-russia-ransomware
  - https://securelist.ru/tr/hacking-cat/117062/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-15
tags:
  - attack.persistence
  - attack.defense-evasion
  - attack.impact
  - attack.t1490
  - attack.t1070.001
  - attack.t1562.001
  - attack.t1547.001
  - attack.t1053.005
  - attack.t1529
  - attack.t1543.003
  - attack.tool.gorilla_rat
  - attack.tool.nemo_wiper
  - attack.tool.monkey_ransomware
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_defender_exclusion:
    CommandLine|contains|all:
      - 'Add-MpPreference'
      - 'Exclusion'
  selection_schtasks_system:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
      - '/create'
      - 'SYSTEM'
  selection_safemode_reboot:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains|all:
      - 'safeboot'
      - 'network'
  selection_netprovider_service:
    CommandLine|contains: 'nplsvc'
  selection_known_hash:
    Hashes|contains:
      - '2EF4FF20CA73F738ED34AE35E700C5FF'
      - 'FD71C1C84954BF51837BF362945AED8E'
      - 'E28C75F68F337B23C2306EFE83756B50'
      - 'CF4840AE85D7ACBA4974D6DD55893D6C'
      - '583FCADF646610BBAC86ADDDDEE75AE0'
      - '257DE0E2744C99A12CBC1C1B37C76E0E8A010DDE3125EC09468A16E4F8E0F121'
      - '647F968D18620D7D69FE51E67A7F2F83DDC8551716472D4468197E2DC8130A94'
      - '36CCDC537914FC9375EBAC92C660A8D4'
      - 'F711847ABFF31937CEBEB23C5D8CDC58'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup software invoking vssadmin for volume shadow copy snapshot management
  - Change-managed Windows Defender exclusion updates by IT/security operations
  - Legitimate IT-support-initiated Safe Mode troubleshooting reboots
level: critical

Known false positives:

• Legitimate backup software invoking vssadmin for volume shadow copy snapshot management
• Change-managed Windows Defender exclusion updates by IT/security operations
• Legitimate IT-support-initiated Safe Mode troubleshooting reboots

Tuning notes: Baseline legitimate backup and Defender-management tooling command lines to suppress benign vssadmin/Add-MpPreference matches; keep the known-hash list synchronized with newly released Hacking Cat sample hashes from Securelist/Hexastrike updates and TL_OSINT_Scan community-corroborated sibling hashes.

• 🔒 Exchange/SharePoint Exploitation Chain (ProxyLogon, OWA XSS CVE-2026-42897, SharePoint InfoPath Deserialization) — KQL Primary · unlock with TL Creds
• 🔒 Gorilla RAT / Monkey Ransomware / Nemo Wiper Persistence & Destructive Preparation — KQL Primary · unlock with TL Creds
• 🔒 Gorilla RAT WebSocket C2 Beaconing (Lissa C2) & Nemo Wiper LSA Delivery — KQL Primary · unlock with TL Creds
• 🔒 Exchange/SharePoint Exploitation Chain (ProxyLogon, OWA XSS CVE-2026-42897, SharePoint InfoPath Deserialization) — Sigma Primary · unlock with TL Creds
• 🔒 Gorilla RAT / Monkey Ransomware / Nemo Wiper Persistence & Destructive Preparation — Sigma Primary · unlock with TL Creds
• 🔒 Gorilla RAT WebSocket C2 Beaconing (Lissa C2) & Nemo Wiper LSA Delivery — Sigma Primary · unlock with TL Creds
• 🔒 Exchange/SharePoint Exploitation Chain (ProxyLogon, OWA XSS CVE-2026-42897, SharePoint InfoPath Deserialization) — SPL Primary · unlock with TL Creds
• 🔒 Gorilla RAT WebSocket C2 Beaconing (Lissa C2) & Nemo Wiper LSA Delivery — SPL Primary · unlock with TL Creds

Indicators of compromise for Hacking Cat ransomware attacks

As of 2026-09-15, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-2515.

Sample indicators (3 of 29)

• IP address: 179.43.186[.]239
• Domain: khinkal[.]net
• File hash: 257de0e2744c99a12cbc1c1b37c76e0e8a010dde3125ec09468a16e4f8e0f121

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Community OSINT corroboration for Hacking Cat ransomware attacks

5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Hacking Cat ransomware attacks works

Kaspersky attributes initial access to exploitation of Microsoft Exchange (CVE-2021-26855, CVE-2026-42897) and SharePoint (CVE-2021-27076), and documents joint operations with Cyber Anarchy Squad (a March 2026 Rosatom contractor breach using ClearWater ransomware) and the Ukrainian Cyber Alliance (a June 2026 destructive Nemo Wiper attack on Donbassteploenergo, a Russian-occupied-Donetsk heating provider).

Hacking Cat is a pro-Ukraine hacktivist group whose Telegram-based presence began in February 2024 with website defacements, data leaks, and the release of penetration-testing tooling targeting Russian organizations. Kaspersky's Securelist research (published alongside The Record's reporting on 2026-09-14) documents the group's pivot, starting around summer 2025, toward destructive operations: data encryption for extortion and outright data/infrastructure destruction, deployed against Russian organizations across multiple economic sectors.

Initial access in the documented intrusions traces to exploitation of internet-facing Microsoft Exchange Server (CVE-2021-26855, the ProxyLogon SSRF chain, and CVE-2026-42897, an OWA cross-site-scripting/spoofing zero-day patched by Microsoft on 2026-06-09 and separately exploited in the wild by the Russia-aligned group Laundry Bear/Void Blizzard against Western government targets) and Microsoft SharePoint Server (CVE-2021-27076, a replay-style InfoPath deserialization RCE). Post-exploitation, the group deploys Gorilla RAT, a previously undocumented Go-based reverse shell that communicates over WebSocket and provides TCP tunneling into the victim's internal network, plus command execution, file transfer, process management, and in some variants VNC access. Gorilla RAT performs anti-analysis checks (sleep-timing validation, minimum memory requirements, and process-name detection for wireshark, fiddler, procmon, x64dbg, x32dbg, ollydbg, ida, pestudio, and processhacker), persists via %LOCALAPPDATA% and a Windows Registry Run key, XOR-obfuscates its embedded C2 addresses, and beacons to its 'Lissa C2' panel roughly every 27-36 seconds (retrying every 12 seconds on failure) after registering victim telemetry (CPU core count, RAM, hostname, IP).

Monkey Ransomware, first observed in the wild in late summer/early fall 2025, was reimplemented by the group across at least four language/platform variants with minor functional differences: a Rust variant using ChaCha20-Poly1305 encryption (extensions .monkey/.xoxol/.benzona), a .NET variant using AES-256-CBC (extensions .monkey/.128bit/.x0x0l) that additionally extracts and exfiltrates stored Outlook credentials, a C++ variant (extensions .monkey/.obliviontea) that disables Task Manager, Command Prompt, Volume Shadow Copy Service, and SQL services and tampers with AMSI/ETW, and a Golang variant targeting Linux/ESXi (.monkeyRansomware extension). Common behavior across variants includes 32-byte key generation, privilege escalation attempts, termination of non-whitelisted processes, Volume Shadow Copy deletion (vssadmin), Windows Defender exclusion additions, Windows Event Log clearing, and PowerShell history deletion; several variants ship without functioning key-storage/recovery logic, meaning they behave as de facto wipers despite presenting a ransom demand. An independently analyzed Golang/Linux ELF sample (SHA256 257de0e2744c99a12cbc1c1b37c76e0e8a010dde3125ec09468a16e4f8e0f121) drops a ransom note at /root/Desktop/README.txt (contact monkeyransomware@onionmail.org, 24-hour deadline with doubling threat), persists via crontab @reboot, /etc/rc.local, and a systemd unit (/etc/systemd/system/monkey.service, Restart=always), attempts sudo re-execution for privilege escalation, disables SELinux/AppArmor/firewall services, collects a SHA-256(hostname||MAC) machine ID plus public IP/geolocation via api.ipify.org and ipapi.co, and reports victim telemetry to 179.43.139.126:5000/api/report/ — but exhibits non-functional encryption logic and Windows-specific command remnants embedded in the Linux binary, consistent with Kaspersky's assessment of AI-assisted, rapidly iterated development.

Nemo Wiper, used in the group's joint operation with the Ukrainian Cyber Alliance, is delivered via a PowerShell script (LSAPlatformUpdate.ps1) that registers a malicious DLL as a Windows network provider and forces a reboot into Safe Mode with Networking. On boot, the malicious network-provider DLL decrypts an embedded payload (nplsvc.exe, 167,436 bytes) using ChaCha20 and launches it as a service with a specific command-line token check; the payload displays a fake Windows Update screen while disabling keyboard and mouse input, then runs destructive wiper threads using a stolen user token. Destruction is size-proportional (overwriting up to 90% of files under 50MB down to roughly 10% of files over 100GB) followed by filling remaining free disk space with ~95MB random '.lock' files, and the tool disables USB mass storage via the HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR registry key to hinder physical remediation.

Attribution is complicated by extensive tool- and infrastructure-sharing among pro-Ukraine hacktivist clusters: in the March 2026 Rosatom-contractor breach, Hacking Cat and Cyber Anarchy Squad jointly deployed ClearWater ransomware via a Base64-encoded PowerShell batch script (1.bat) that contained a C2 IP typo (19.43.186.239 instead of 179.43.186.239); in the June 2026 Donbassteploenergo attack, Hacking Cat and the Ukrainian Cyber Alliance used an evolved version of the LSA network-provider delivery chain to drop Nemo Wiper instead of ransomware. Kaspersky correlated multiple C2 hosts (179.43.186.239, 179.43.186.246, 31.7.58.226) via shared SSH fingerprints on Private Layer-leased infrastructure; a co-located address (179.43.186.194) hosts the group's 'Cat Eyes OSINT' page, and historical Cobalt Strike C2 activity was observed on the same hosting cluster during 2025. Kaspersky also flags a possible connection to the 'Thor' cluster via shared exploitation of CVE-2021-27076 with exfiltration to 95.142.40.51. Hacking Cat responded on Telegram, acknowledging some tools ('a couple of the tools are ours') while denying involvement in the ransomware operations, underscoring the report's central finding that a common developer or small group likely builds and redistributes tooling across multiple nominally distinct hacktivist operations.

MITRE ATT&CK techniques by tactic:

Persistence

T1053.003 Scheduled Task/Job: Cron; T1053.005 Scheduled Task/Job: Scheduled Task; T1543.003 Create or Modify System Process: Windows Service; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.001 Command and Scripting Interpreter: PowerShell

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1572 Protocol Tunneling

Discovery

T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1561.001 Disk Wipe: Disk Content Wipe

Defense Evasion

T1497 Virtualization/Sandbox Evasion

Privilege Escalation

T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Credential Access

T1555 Credentials from Password Stores

Lateral Movement

T1570 Lateral Tool Transfer

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Remediation for Hacking Cat ransomware attacks

Patches

• Microsoft Exchange Server cumulative update addressing CVE-2021-26855
• Microsoft Exchange Server security update for CVE-2026-42897 (released 2026-06-09)
• Microsoft SharePoint Server 2019 security update KB4493230 (CVE-2021-27076)

Immediate actions

• Patch/verify Microsoft Exchange Server against CVE-2021-26855 (ProxyLogon SSRF) and CVE-2026-42897 (OWA XSS/spoofing, fixed 2026-06-09)
• Patch Microsoft SharePoint Server against CVE-2021-27076 (InfoPath deserialization RCE, KB4493230 and later)
• Hunt for scheduled tasks created as SYSTEM via schtasks and for unexpected Windows network-provider DLL registrations
• Block/monitor the identified C2 IP ranges (179.43.186.0/24, 31.7.58.226, 179.43.139.126) and the domain khinkal.net at the network perimeter
• Audit Windows Defender exclusion lists and AMSI/ETW state for unauthorized modifications
• Restrict or alert on unattended reboots into Safe Mode with Networking on servers

Workarounds

• Disable OWA external access or enforce strict CSP/sanitization pending patch validation for CVE-2026-42897
• Restrict SharePoint InfoPath forms services where not required
• Place Exchange/SharePoint servers behind a reverse proxy/WAF with virtual patching for known exploit patterns

Longer-term hardening

• Deploy EDR/NDR with behavioral detection for WebSocket-based reverse-shell C2 and ransomware/wiper file-activity patterns (mass rename, VSS deletion, free-space fill)
• Enforce offline/immutable backups and test recovery against a wiper scenario (not just ransomware) given multiple variants lack functional decryption
• Harden credential storage (disable/limit Outlook password caching, deploy credential-guard) given documented Outlook credential theft
• Network-segment Exchange/SharePoint servers from the broader environment to limit lateral tool transfer after initial compromise
• Restrict/monitor USB storage policy enforcement (HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR) tampering as a wiper post-destruction indicator

Affected and fixed versions

• Microsoft — Exchange Server
  Vulnerable versions: Exchange Server 2013 CU21-23; Exchange Server 2016 CU8-19; Exchange Server 2019 (base and CU1-8); Exchange Server 2016/2019/Subscription Edition (pre 2026-06-09 patch, OWA)
  Fixed in: Post-2021 cumulative updates addressing CVE-2021-26855; 2026-06-09 security update addressing CVE-2026-42897
• Microsoft — SharePoint Server
  Vulnerable versions: SharePoint Server 2019 pre-March 2021
  Fixed in: SharePoint Server 2019 with KB4493230 and later

Timeline of Hacking Cat ransomware attacks

• 2024-02-01 Hacking Cat's Telegram-based presence launches, beginning with website defacements, data leaks, and pentest-tool releases targeting Russian organizations.
• 2025-01-01 Kaspersky observes historical Cobalt Strike C2 activity during 2025 on the same Private Layer-hosted IP cluster (locked-ioc-20, 179.43.186.223) later reused for Hacking Cat's locked-ioc-25 and locked-ioc-28 infrastructure.
• 2025-06-01 By summer 2025 Hacking Cat shifts its operational focus from defacement/leaks toward data-encryption and data-destruction campaigns against Russian organizations.
• 2025-09-01 locked-ioc-15 first appears in the wild in late summer/early fall 2025, subsequently reimplemented by the group in Rust, .NET, C++, and Golang variants.
• 2025-10-16 Hexastrike Cybersecurity publishes independent reverse-engineering analysis of a Golang/Linux ELF locked-ioc-15 sample (SHA256 locked-ioc-1), noting AI-assisted, non-functional encryption logic.
• 2026-03-01 Hacking Cat and Cyber Anarchy Squad jointly breach a contractor working for Rosatom, Russia's state nuclear energy corporation, deploying locked-ioc-28 ransomware via a Base64-encoded PowerShell batch script.
• 2026-05-15 Microsoft discloses CVE-2026-42897, an Exchange Server OWA cross-site-scripting/spoofing vulnerability under active exploitation in the wild, subsequently cited by Kaspersky as one of Hacking Cat's Exchange initial-access vectors.
• 2026-06-01 Hacking Cat and the Ukrainian Cyber Alliance conduct a destructive attack on locked-ioc-14, a state-owned heating provider in Russian-occupied Donetsk, deploying locked-ioc-27 via an evolved LSA network-provider delivery chain.
• 2026-06-09 Microsoft releases the security update addressing CVE-2026-42897 for on-premises Exchange Server.
• 2026-09-14 Kaspersky publishes Securelist research on Hacking Cat's toolkit (locked-ioc-25, locked-ioc-15, locked-ioc-27); The Record reports on the findings the same day, and Hacking Cat responds on Telegram partially acknowledging but disputing aspects of the attribution.

Sources cited for Hacking Cat ransomware attacks

• CVE-2021-26855 - Microsoft Exchange Server Remote Code Execution Vulnerability (NVD) NVD (NIST) · Advisory · 2021-03-02
• CVE-2021-27076 - Security Update Guide - Microsoft Microsoft Security Response Center · Advisory · 2021-03-09
• Разбираем инструментарий группировки Hacking Cat (Хакерский кiт) securelist.ru · Research · 2026-09-14
• Addressing Exchange Server May 2026 vulnerability CVE-2026-42897 Microsoft · Vendor report · 2026-06-09
• CVE-2021-27076: A Replay-Style Deserialization Attack Against SharePoint thezdi.com · Research · 2021-03-17
• Monkey Ransomware — Some AI-written Ransomware hexastrike.com · Blog · 2025-10-16
• Pro-Ukraine Hacking Cat group deploying new malware against Russian targets The Record · News · 2026-09-14
• Unpatched Microsoft Exchange Server vulnerability exploited (CVE-2026-42897) Help Net Security · News · 2026-05-15
• On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email The Hacker News · News · 2026-05-15
• Laundry Bear's new Microsoft Exchange attack triggers on email open (CVE-2026-42897) Help Net Security · News · 2026-07-30

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

Other reports on CVE-2021-26855

• US posts $10M Rewards for Justice bounty for accused Hafnium hacker Zhang Yu (MSS-directed intrusion campaign)
• Recorded Future H1 2026 Report: Actively Exploited CVEs Up 34%, Ransomware Adopts BYOVD and Post-Quantum Crypto
• StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike
• SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike
• SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark Campaign
• AhnLab ASEC April 2026 APT Group Trend Report: State-Sponsored Espionage Campaigns (CVE-2026-32202, CVE-2025-20333/20362, CVE-2021-26855)

Other reports on CVE-2026-42897

• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• Russian TA488 (Void Blizzard / Laundry Bear) Exploits Exchange OWA Zero-Day (CVE-2026-42897) with OWAReaper Backdoor for Long-Term Mailbox Access
• Microsoft Exchange Server OWA Cross-Site Scripting Zero-Day CVE-2026-42897 Exploited In the Wild

Previous and next in ransomware

• Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass Previous report
• Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices Next report