ChaCha20

Broken by Design: How VECT 2.0 Ransomware Becomes a Permanent Data Wiper

• Malware

Broken by Design: How VECT 2.0 Ransomware Becomes a Permanent Data Wiper

Do Son April 30, 2026 0

Check Point Research reveals VECT 2.0 ransomware is a broken wiper. A critical flaw makes file recovery impossible for files over 128KB. Read the analysis.

Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

• Malware

Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

Do Son March 30, 2026 0

Morphisec uncovers Pay2Key’s Linux evolution. This dual-arch ransomware disables SELinux and AppArmor to encrypt x64/ARM64 servers. Secure your infra today!

New Yurei Ransomware Emerges: Go-Based Threat Uses ChaCha20-Poly1305 for Irreversible Double Extortion

• Malware

New Yurei Ransomware Emerges: Go-Based Threat Uses ChaCha20-Poly1305 for Irreversible Double Extortion

Do Son November 17, 2025 0

ASEC exposed Yurei, a new Go-based ransomware group using ChaCha20-Poly1305/ECIES for irreversible encryption. The stealthy RaaS operates with minimal initial setup and focuses on double extortion.

Lazarus Group Attacks Aerospace/Defense with New ChaCha20-Encrypted Comebacker Backdoor

• Cyber Security
• Malware

Lazarus Group Attacks Aerospace/Defense with New ChaCha20-Encrypted Comebacker Backdoor

Do Son November 11, 2025 0

ENKI exposed a Lazarus Group espionage campaign targeting aerospace/defense firms. The new Comebacker variant uses malicious Word macros and ChaCha20/AES to deliver a memory-resident backdoor.

Midnight Ransomware Decryption Flaw: Babuk Successor’s RSA Implementation Mistake Allows Free File Recovery

• Malware

Midnight Ransomware Decryption Flaw: Babuk Successor’s RSA Implementation Mistake Allows Free File Recovery

Do Son October 30, 2025 0

A Babuk successor, Midnight ransomware, contains a critical flaw in its RSA key handling. Gen researchers created a free decryptor that bypasses the encryption, allowing victims to recover files.

AhnLab Uncovers Gunra Ransomware: Dual-Platform Threat with Weak Linux Encryption

• Malware

AhnLab Uncovers Gunra Ransomware: Dual-Platform Threat with Weak Linux Encryption

Do Son October 29, 2025 0

ASEC exposed a flaw in Gunra Linux ransomware: its ChaCha20 keys are generated using an insecure time()/rand() seed, potentially allowing victims to brute-force decryption and recover files.

Beast Ransomware Emerges as New RaaS Threat, Using ChaCha20 and Stealthy VSS Deletion

• Cybercriminals

Beast Ransomware Emerges as New RaaS Threat, Using ChaCha20 and Stealthy VSS Deletion

Do Son October 29, 2025 0

AhnLab exposed Beast ransomware (Monster evolution) as a new RaaS threat, with 16+ victims by August 2025. It uses ChaCha20 encryption, deletes Shadow Copies, and features a hidden GUI control panel.

The Evolution of Evasion: Raspberry Robin Malware Upgrades with New Encryption & UAC Bypass Exploit

• Malware

The Evolution of Evasion: Raspberry Robin Malware Upgrades with New Encryption & UAC Bypass Exploit

Do Son August 5, 2025 0

ThreatLabz reveals the evolution of Raspberry Robin malware, now featuring stronger encryption, complex obfuscation, and a new privilege escalation exploit to bypass detection.

FunkSec Ransomware Decryptor Released Free: Victims Can Now Recover Files After Group Goes Dormant

• Malware

FunkSec Ransomware Decryptor Released Free: Victims Can Now Recover Files After Group Goes Dormant

Do Son August 1, 2025 0

Gen Digital has released a free decryptor for FunkSec ransomware, allowing victims to recover files. The group appears dormant, with no new victims since March 2025.

CVE-2024-33112 and More: How FICORA and CAPSAICIN Botnets Are Exploiting D-Link Devices

• Malware
• Vulnerability

CVE-2024-33112 and More: How FICORA and CAPSAICIN Botnets Are Exploiting D-Link Devices

Do Son December 28, 2024 0

Learn about the recent spike in botnet activity from FICORA and CAPSAICIN targeting D-Link devices and the vulnerabilities they exploit.

DigiEver DVR Vulnerability Under Attack by Hail Cock Botnet

• Malware
• Vulnerability

DigiEver DVR Vulnerability Under Attack by Hail Cock Botnet

Do Son December 22, 2024 0

Discover the dangerous Hail Cock botnet and its target: the vulnerable DigiEver DS-2105 Pro DVRs. Learn how to safeguard your devices.

Trinity Ransomware: A New Player with Troubling Connections to Established Threats

• Cyber Security
• Malware

Trinity Ransomware: A New Player with Troubling Connections to Established Threats

Do Son May 12, 2024 0

CRIL published a detailed analysis of a newly identified ransomware variant named Trinity, highlighting its potential links to Venus ransomware

From TEA to ChaCha20: The Evolution of the Rimasuta Botnet

• Malware

From TEA to ChaCha20: The Evolution of the Rimasuta Botnet

Do Son January 13, 2024 0

Rimasuta botnet is designed to infiltrate systems and evade detection. It employs advanced data encryption and communication techniques