Volcano Demon Ransomware Gang Makes Phone Calls to Victim for Ransom

Halcyon AI and reporting describe a new ransomware operator called "Volcano Demon" using a ransomware variant named LukaLocker (encrypts files with a .nba extension), which exfiltrates sensitive data to C2 servers, clears logs to hinder forensics, and pressures victims through frequent threatening phone calls rather than public leak sites; at least two victim incidents in manufacturing and logistics are reported.