Monkey Ransomware Multi-Platform Threat Hits Russian Enterprises

The ransomware landscape has undergone a dramatic transformation in 2026, with hacktivist groups evolving from simple website defacements to deploying sophisticated multi-platform ransomware strains. According to a major new report from Kaspersky published in September 2026, three distinct threat clusters — tracked as NightEagle, Hacking Cat, and Toy Ghouls — have been targeting Russian enterprises with an arsenal of backdoors, ransomware, and wiper malware that represents a significant escalation in cyber conflict tactics.

The Monkey Ransomware Family: A Multi-Platform Threat

At the center of Kaspersky’s findings is a ransomware family dubbed Monkey, which has been deployed by the pro-Ukrainian hacktivist group Hacking Cat against Russian enterprises. What makes Monkey particularly notable is its development across four separate programming languages — Rust, .NET, C++, and Golang — allowing it to target Windows, Linux, and VMware ESXi systems simultaneously. The earliest Monkey ransomware artifact dates back to late summer 2025, indicating months of development before its current widespread deployment.

The Rust-based variant generates a 32-byte encryption key and uses ChaCha20-Poly1305 to lock victim files. However, in a disturbing twist, some variants do not store the key anywhere, effectively turning the ransomware into a wiper — a destructive tool that permanently destroys data regardless of whether a ransom is paid. These variants still leave a ransom note, creating a deceptive appearance of negotiability when recovery is mathematically impossible.

Variant-by-Variant Breakdown

• .NET Variant: Generates a 32-byte key, transmits it to a command-and-control server, and encrypts files using AES-256-CBC. It can escalate privileges, disable Windows recovery mechanisms, extract Microsoft Outlook credentials, delete backup files with extensions like .bak and .backup, and remove itself after execution.
• C++ Variant: Establishes persistence through scheduled tasks or RunOnce registry keys. It clears system logs, disables logging, wipes PowerShell history, bypasses AMSI, turns off Event Tracing for Windows, configures Microsoft Defender exclusions, and disables the Volume Shadow Copy Service to prevent recovery.
• Golang Variant: Primarily targets Linux and ESXi environments. It establishes persistence via crontab entries, disables SELinux and AppArmor, and attempts to delete volume shadow copies — a feature that serves no purpose on Linux, leading Kaspersky to theorize the attackers used AI tools in development.

From Hacktivism to Destructive Cyber Warfare

Hacking Cat, active since February 2024, initially focused on website defacements and data breaches. The group’s pivot to encryption and destructive attacks marks a significant tactical shift in the hacktivist ecosystem. The group actively collaborates with other pro-Ukrainian entities including Cyber Anarchy Squad and the Ukrainian Cyber Alliance, creating a complex attribution challenge for security researchers.

In one collaborative operation, Hacking Cat teamed up with Cyber Anarchy Squad to deploy a ransomware strain called ClearWater, which is believed to be distributed under a ransomware-as-a-service model specifically to pro-Ukrainian hacktivist crews. In another operation alongside the Ukrainian Cyber Alliance, the group deployed a wiper malware known as Nemo Wiper that overwrites files with random bytes and fills remaining disk space with files containing random alphanumeric names and a .lock extension.

Kaspersky noted that different hacktivist groups are using the same self-written tools across different attacks, including multi-stage infection chains. This pattern suggests the existence of a common source — potentially a developer or small group of developers who create, maintain, and modify malware that is subsequently distributed to various hacktivist groups.

The NightEagle Cluster: Advanced Persistence Techniques

The first threat group identified by Kaspersky, NightEagle (also tracked as APT-Q-95), has been active since at least 2023 and has demonstrated increasingly sophisticated techniques for persistence and lateral movement within corporate networks.

The group typically gains initial access through compromised valid credentials to corporate VPNs, with connections originating from IP addresses linked to Cloudflare WARP tunnels and European virtual infrastructure providers. Once inside, NightEagle deploys GhostContainer, a modular backdoor that grants complete access to Microsoft Exchange Server and can run arbitrary code, perform file operations, and load additional modules.

GhostContainer is particularly stealthy, masquerading as a common server component to blend in with regular operations. It incorporates components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for CVE-2020-0688, and the GhostWebShell class from the ysoserial utility — all publicly available on GitHub.

For lateral movement, NightEagle exploits vulnerabilities in Active Directory, including the infamous CVE-2019-0708 (BlueKeep), to create local administrator accounts. The group has also attempted DCSync attacks to impersonate domain controllers, with the ultimate goal of compromising entire Active Directory infrastructures.

Infrastructure Vulnerabilities Amplify Ransomware Risk

The Kaspersky report comes at a time when critical infrastructure vulnerabilities are being actively exploited. In a parallel development, Cisco warned of a maximum-severity zero-day flaw (CVE-2026-76460, CVSS 10.0) in its Identity Services Engine that has come under active exploitation. The vulnerability allows unauthenticated remote attackers to bypass authentication and gain root-level command execution.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on September 16, 2026, requiring federal agencies to apply patches by September 19. Such infrastructure-level vulnerabilities provide ideal entry points for ransomware operators seeking to compromise enterprise environments before deploying encryption payloads.

Defensive Strategies for the New Ransomware Era

The convergence of hacktivist motivations with ransomware-as-a-service infrastructure creates a threat environment where attacks are both ideologically driven and technically sophisticated. Organizations should consider the following defensive measures:

• Patch Critical Infrastructure Immediately: The Cisco ISE zero-day demonstrates how authentication bypass vulnerabilities can give attackers root access. Prioritize patches for all network infrastructure devices, especially those with CVSS scores of 9.0 or higher.
• Secure VPN Access: NightEagle’s use of compromised credentials to access corporate VPNs highlights the need for multi-factor authentication on all remote access points. Monitor VPN connections for unusual IP addresses and geographic anomalies.
• Implement Immutable Backups: With Monkey ransomware variants specifically targeting backup files and Volume Shadow Copies, organizations must maintain offline or immutable backup copies that cannot be deleted or encrypted by attackers.
• Monitor for Wiper Disguises: Since some Monkey ransomware variants function as wipers while leaving ransom notes, organizations should not assume that paying a ransom will result in data recovery. Incident response plans should account for destructive malware scenarios.
• Deploy EDR with Anti-Tamper Protection: The C++ variant of Monkey ransomware actively disables Microsoft Defender, AMSI, and ETW. Endpoint detection and response solutions with robust anti-tamper mechanisms are essential for detecting these evasion techniques.
• Audit Active Directory Regularly: NightEagle’s exploitation of Active Directory vulnerabilities to achieve domain dominance underscores the importance of regular AD security assessments and prompt patching of known vulnerabilities.

The AI Connection in Ransomware Development

One of the most striking observations from the Kaspersky report is the evidence that AI tools may be playing a role in ransomware development. The Golang variant of Monkey ransomware includes functionality for removing shadow volume copies — a Windows-specific feature that serves no purpose on Linux or ESXi systems. Kaspersky theorized this oversight suggests the attackers were careless and likely used AI in developing the toolkit, as an experienced developer would not include platform-irrelevant functionality.

This finding aligns with broader trends identified throughout 2026, where ransomware groups have been documented weaponizing AI coding assistants to accelerate malware development. The democratization of malware creation through AI tools means that less technically skilled threat actors can now produce sophisticated, multi-platform ransomware — lowering the barrier to entry for destructive cyber operations.

Looking Ahead

The Kaspersky findings reveal a ransomware ecosystem that is simultaneously becoming more ideologically diverse and more technically sophisticated. The blurring of lines between hacktivism, ransomware-as-a-service, and nation-state cyber operations creates an attribution challenge that complicates defensive planning. As threat groups share tools, collaborate across alliances, and leverage AI for malware development, organizations must adopt defense-in-depth strategies that do not rely on any single security control.

The Monkey ransomware family, with its four-language implementation and wiper capabilities, exemplifies the new normal: ransomware that is platform-agnostic, potentially destructive beyond recovery, and developed with modern tooling that accelerates the threat lifecycle. Enterprises that treat ransomware purely as an encryption problem — rather than a potential data destruction event — risk being unprepared for the reality of 2026’s threat landscape.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous