HelloKitty ransomware gang behind CD Projekt hack
Emsisoft CTO tells IT Pro that the sensitive data obtained by the attackers 'will most likely be leaked'


The cyber attack on Cyberpunk 2077 developer CD Projekt was likely orchestrated by the same ransomware gang responsible for targeting Brazillian energy company CEMIG late last year.
That's according to Emsisoft CTO Fabian Wosar, who shared his findings regarding this week's attack on Twitter.
The ransomware gang responsible for the incident is known to security researchers as 'HelloKitty', named after the mutex deployed when the malware executable is launched, as explained by BleepingComputer.
Wosar came to the conclusion after comparing the ransom notes left on both occasions and finding convincing similarities. He also debunked the possibility that the attack on CD Projekt was orchestrated by a former employee or a customer left unsatisfied by the developer’s latest release, Cyberpunk 2077. Following its launch in December 2020, the game had garnered headlines due to being plagued with bugs.
“This has nothing to do with disgruntled gamers and is just your average ransomware,” he said on Twitter. “I can see the appeal of the 'this was revenge by a former fan', but life is much more boring than that.”
In a statement confirming the attack, CD Projekt made it clear that they were not intending to give in to the hackers' demands nor pay the ransom.
Asked about the likely consequences of this decision, Wosar told IT Pro that the data obtained by HelloKitty, which includes documents containing accounting, administration, legal, HR, and investor relations information, “will most likely be leaked”.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Speculating about the identity of the hackers, Wosar said that he “wouldn't be surprised if the group or the affiliate who pulled off the hack grew up with western culture”.
“They certainly have a better command of the English language than your average ransomware thug. The ransomware is also missing the usual check for CIS countries,” he added.
According to Wosar, HelloKitty has been active since November 2020. In December, the group targeted Brazillian electric power provider CEMIG in an attempt to obtain a large amount of the company’s data. The company stated that the ransomware attack “caused limited damage” but managed to impact the company’s online service to its customers.
Having only graduated from City University in 2019, Sabina has already demonstrated her abilities as a keen writer and effective journalist. Currently a content writer for Drapers, Sabina spent a number of years writing for ITPro, specialising in networking and telecommunications, as well as charting the efforts of technology companies to improve their inclusion and diversity strategies, a topic close to her heart.
Sabina has also held a number of editorial roles at Harper's Bazaar, Cube Collective, and HighClouds.
-
Palo Alto Networks snaps up CyberArk in identity security push
News The acquisition marks the latest in a string for Palo Alto Networks
-
Stack Overflow CEO Prashanth Chandrasekar on embracing AI
Q&A The chief executive at the well-known developer resource Stack Overflow talks future strategy and how AI has forced the company to shift its focus
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employees
News The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making