logo

HelloKitty ransomware rebrands, releases CD Projekt and Cisco data

ID: 89ac30e8-07f0-599d-bbfa-17536208244e

STIX ID: report--89ac30e8-07f0-599d-bbfa-17536208244e

Feed Name: Bleeping Computer

Threat Score
70/100

Date Published: 2024-04-19

Date Updated: 2026-04-20

Author: Bill Toulas

...
...

HelloKitty, a known ransomware operation, has rebranded as "HelloGookie" and published a new leak site containing four private decryption keys for older HelloKitty encryptors, stolen Cisco NTLM hashes, and large volumes of CD Projekt source code (including Witcher 3, Gwent, and Cyberpunk assets). The announcement includes claims by the actor 'Gookee/kapuchin0' of being the original developer, shows ties to Yanluowang, and has already resulted in community builds compiled from the leaked code while researchers investigate which encryptor versions the keys unlock.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.