Threat Advisories:

Click, Paste, Compromise: Inside the New FileFix Campaign Hive0154 Evolves with SnakeDisk and EnhancedToneshell Backdoor HybridPetya: A Bootkit-Enabled Ransomware Threat EvilAI Malware Exploits the Trust in Artificial Intelligence kkRAT Malware Campaign Targeting Chinese-Speaking Users ZynorRAT: Go-Based Malware Taking Shape on Telegram Microsoft September 2025 Patch Tuesday Roundup The Gentlemen Ransomware: A Rising Global Cyber Threat MostereRAT: A Deep Dive into an EPL-Backed Phishing Operation Stealerium Changing the Rules of Cyber Espionage s1ngularity Nx Supply Chain Attack: AI-Driven Credential Theft & Mass Exposure GPUGate: Weaponizing Ads and GitHub to Outsmart Sandboxes Cephalus Ransomware a Wake-Up Call for Stronger Endpoint Defense Sitecore Zero-Day Powers Reconnaissance Malware TP-Link Router End-of-Service Models Exploited in Botnet Operation GhostRedirector Targets Windows Servers Globally for SEO Fraud CVE-2025-55177: WhatsApp Zero-Click Flaw Used in Targeted Campaigns Experimental AI Ransomware PromptLock Sparks Security Concerns NightSpire Ransomware Expands Reach with Aggressive Extortion Deadlines Operation HanKook Phantom: APT37’s Stealthy Espionage Campaign

Hive Force Labs: Critical Threats Affecting You This Week - 5 Minute Audio Intelligence Report

Play Count: Loading...

Partner Program

Book a Demo Threat Digest - Subscribe

HelloKitty is launching a DDoS attack by exploiting known vulnerabilities

Threat Level – Red | Vulnerability Report

For a detailed advisory, download the pdf file here.

The FBI has issued a warning to private businesses about a new feature of the HelloKitty ransomware group (aka FiveHands). The Hello Kitty/FiveHands actor (UNC2447) employs the double extortion strategy to place undue pressure on victims. If the victim fails to respond quickly or pay the ransom, the threat actors may launch a Distributed Denial of Service (DDoS) attack on the target company’s public website. HelloKitty achieves first access by exploiting known SonicWall flaws (CVE-2021-20016, CVE-2021-20021, CVE-2021-20022, CVE-2021-20023). Patches for these vulnerabilities are widely accessible.

Vulnerability Details

Actors Details

Indicators of Compromise (IoCs)

Patch Link

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0008

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0010

References

https://www.ic3.gov/Media/News/2021/211029.pdf

https://apt.thaicert.or.th/cgi-bin/showcard.cgi?g=UNC2447

https://securityaffairs.co/wordpress/124059/malware/hellokitty-ransomware-fbi-alert.html

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox