CyberVolk Hackers Group With New VolkLocker Payloads Attacks both Linux and Windows Systems

CyberVolk resurfaced in 2025 with VolkLocker, a Golang-based, cross-platform ransomware-as-a-service that uses an ms-settings UAC bypass for privilege escalation, performs virtual environment detection to evade analysis, and leverages Telegram automation; analysts note embedded test artifacts and lack of obfuscation that create potential recovery and detection opportunities.