Flaw in Hacktivist Ransomware Lets Victims Decrypt Own Files

SentinelOne analysis details the resurgence of CyberVolk's VolkLocker RaaS — a pro-Russia-aligned hacktivist ransomware service that uses Telegram for automated C2 and offers licenses and malware tools for sale — but contains a critical implementation error: a hard-coded master encryption key that the binary writes to a plaintext backup file in %TEMP%, enabling victim self-recovery; the report also provides IoCs (Windows/Linux indicators, a Bitcoin address, and a Telegram bot token).