CyberVolk

CyberVolk is an India-origin, pro-Russian hacktivist collective that evolved rapidly from disruptive activism into a hybrid ecosystem combining DDoS, ransomware, malware development and RaaS-style commercialization. Public reporting traces the organization through earlier labels including GLORIAMIST India and Solntsevskaya Bratva before adoption of the CyberVolk brand in June 2024. The collection-context aliases CyberVolk BlackEye and CyberVolk Group should be retained, while vendor reporting additionally records multiple adjacent names and sub-brands.

CyberVolk's operational model is unusual because financially coercive ransomware is integrated into an overtly geopolitical hacktivist identity rather than being treated solely as a criminal revenue stream. In 2024 the group coordinated DDoS and ransomware activity in pro-Russian campaigns, including retaliation-linked targeting of Spanish entities. SentinelOne documented ransomware derived from code associated with the AzzaSec/Babuk lineage and additional group-developed or distributed stealer and webshell tools.

After a period of reduced visibility associated with Telegram enforcement, CyberVolk returned in 2025 with VolkLocker / CyberVolk 2.x. SentinelOne's December 2025 analysis shows materially more mature host-impact functionality: UAC bypass using the ms-settings mechanism, virtualization/sandbox checks, PowerShell-based Defender impairment, termination of analysis tools, persistence through startup/system-path copies, file encryption, deletion of user data, Volume Shadow Copy removal, Telegram-based victim/operator management and a destructive deadline path capable of forcing a system crash.

Key judgment — high confidence: CyberVolk should not be modeled as a conventional single-purpose ransomware gang. It is better understood as a politically aligned, brand-flexible hacktivist-malware ecosystem whose risk combines availability disruption, destructive/extortion impact and public influence signaling.

INFERENCE (confidence: high): the group's ability to alternate between DDoS, ransomware development and coalition-based hacktivism increases resilience because operational continuity does not depend on one access vector, one malware family or one public channel.