Kanti: A NIM-Based Ransomware Unleashed in the Wild

Cyble Research and Intelligence Labs analyzed a NIM-built ransomware strain named “Kanti” distributed via a malicious ZIP/LNK lure targeting cryptocurrency users; the Windows PE executes despite a .zip extension, enumerates files (excluding system items), encrypts data using secure RNG (BCryptGenRandom), renames files with the .kanti extension, drops a Kanti.html ransom note, and includes file hashes and IOCs along with mitigation recommendations.