'CyberVolk' hacktivists use ransomware in support of Russian interests

Researchers have observed CyberVolk, a hacktivist group active since at least March 2024, carrying out DDoS, ransomware, and info-stealer operations against state, public, and critical infrastructure entities in countries including Japan, France, and the U.K.; the group reuses leaked ransomware code (from AzzaSec) and other families (HexaLocker, Parano, LockBit, Chaos) and exfiltrates stolen data via Discord while demanding modest cryptocurrency ransoms.