YourCyanide: An Investigation into ‘The Frankenstein’ Ransomware that Sends Malware Laced Love Letters

CloudSEK researchers detail the YourCyanide ransomware: a CMD/batch-based, multi-stage strain distributed via Discord attachments and Pastebin that downloads a dropper (YourCyanide.exe) which fetches heavily obfuscated batch ransomware and a C# Discord token stealer (GetToken.exe). The malware achieves persistence via Run registry keys and Startup, terminates security services and common processes, encrypts user data with a .cyn extension, steals system and application data (including Discord tokens and Minecraft files), exfiltrates information to a Telegram bot, and includes IoCs and mitigations.