The HelloXD ransomware family was first observed in late 2021. The ‘commercial’ ransomware is tied to specific sellers active in known ‘underground’ forums/marketplaces. Over the last couple of months, operators of HelloXD have increased activity and introduced updated versions of the HelloXD payload. The most recent updates are focused on detection evasion and the speed/efficiency of encryption.
Upon infection, victims are instructed to contact the attacker(s) via Tox Chat.
HelloXD also attempts to inhibit recovery by deleting Volume Shadow Copies (VSS).
In some of the recent campaigns, the attackers are also leveraging an open-source backdoor tool (MicroBackdoor).
#cybersecurity #ransomware #XDR #mindware
SentinelOne PartnerOne - America's 2025
⛳️ Last week in Pebble Beach the America's best cybersecurity partners came together for our annual PartnerOne summit. Check out…
Just a Sec: Cybersecurity Unfiltered—Fast, Frank, and From the Front Lines
Welcome to the first-ever Just A Sec, a no-holds-barred, quick-fire monthly livestream. It’s cybersecurity like you’ve never heard it before—unfiltered,…
See how our intelligent, autonomous cybersecurity platform harnesses the power of data and AI to protect your organization now and into the future.