New threat actor targets Bulgaria, China, Vietnam and other countries with customized Yashma ransomware
Summary: Cisco Talos assessed with high confidence that a threat actor using a customized Yashma ransomware variant is targeting victims in English-speaking countries, Bulgaria, China and Vietnam, based on ransom notes in those languages on a GitHub account named "nguyenvietphat." The actor compiled the variant on June 4, 2023, the same date they joined GitHub and created a public "Ransomware" repository, and the ransomware executes an embedded batch file that downloads the ransom note from that repository rather than storing note strings in the binary.
What you should know: The variant wipes each original file's contents, writes a single "?" character and then deletes it, which makes recovery of unencrypted data from the victim's drive harder for incident responders and forensic analysts. The ransom doubles if payment is not made within three days, and the note text mimics WannaCry, which Talos says may be intended to confuse incident responders.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026