Exposing HelloXD Ransomware and x4k
Summary: Unit 42 analyzed HelloXD, a ransomware family first observed on Nov. 30, 2021 that performs double extortion on Windows and Linux, appends the .hello extension, and directs victims to TOX chat and onion messengers rather than a leak site. The samples copy leaked Babuk/Babyk source code, and one variant drops a MicroBackdoor payload to System32 as userlogin.exe whose hardcoded C2 IP led researchers to an email address and infrastructure tied to a developer alias, x4k.
Why it matters: The backdoor's hardcoded C2 address let Unit 42 pivot through an email to domains, VirusTotal graphs and forum accounts attributed to x4k - meaning the same operator's infrastructure and Cobalt Strike Beacons are already mapped, and that visibility is only available to defenders who look for it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·