Monday, May 5, 2025
HomeCyber Security NewsThreat Actors English-Speaking Countries with Customized Yashma Ransomware

Threat Actors English-Speaking Countries with Customized Yashma Ransomware

Published on

SIEM as a Service

Follow Us on Google News

An unidentified threat actor has deployed the Yashma ransomware variant since June 4, 2023, actively targeting English-speaking countries like:-

  • Bulgaria
  • China
  • Vietnam

While this new variant of Yashma ransomware has reemerged after being fixed last year since the release of a decryptor.

This operation was recently identified by the cybersecurity researchers at Cisco Talos, who linked this operation, with moderate confidence, to a probably Vietnamese-origin threat actor.

- Advertisement - Google News

Threat Actor’s origin 

Talos highly believes the threat actor targets English-speaking countries due to ransomware notes on the ‘nguyenvietphat’ GitHub account. 

Besides this, the English version suggests the actual intent of the threat actor to target various geographic regions.

GitHub account name and email contact in ransom notes mimic Vietnamese organizations, implying the threat actor’s origin. The ransom note specifies 7-11 p.m. UTC+7 contact time, aligning with the time zone of Vietnam.

Ransom Note Mimics WannaCry Style

The ransom note of the attacker mimics WannaCry’s style, and the ransom gets doubled after three days. While for communication, the threat actor provides a Gmail address and lack of ransom amount, and Bitcoin in the note suggests that the operation is in the early stage.

Ransom notes samples (Source – Cisco Talos)

Once systems are encrypted, the victim’s wallpaper changes to a note of encryption. Yashma ransomware is a rebrand of Chaos ransomware from May 2022, and this new variant mostly retains the features of the original ransomware.

WannaCry style ransom encryption screen (Source – Cisco Talos)

The ransom note mimics the style of WannaCry ransomware, potentially aimed at confusing the targets and hiding the identity of the threat actor.

WannaCry style screen (Source – Cisco Talos)

However, the new variant downloads the ransom note from a threat actor’s GitHub repo instead of storing it within the ransomware.

This transformation evades the endpoint detection and AV tools that typically spot embedded ransom note strings.

In this variant, the threat actor retains Yashma’s anti-recovery ability. After encryption, files are wiped, a single character ‘?’ is written, and then the file is deleted, which complicates the recovery.

Moreover, it’s been observed by researchers a significant surge in the emergence of various ransomware strains.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

NCSC Warns of Ransomware Attacks Targeting UK Organisations

National Cyber Security Centre (NCSC) has issued technical guidance following a series of cyber...

Claude AI Abused in Influence-as-a-Service Operations and Campaigns

Claude AI, developed by Anthropic, has been exploited by malicious actors in a range...

Threat Actors Attacking U.S. Citizens Via Social Engineering Attack

As Tax Day on April 15 approaches, a alarming cybersecurity threat has emerged targeting...

TerraStealer Strikes: Browser Credential & Sensitive‑Data Heists on the Rise

Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

NCSC Warns of Ransomware Attacks Targeting UK Organisations

National Cyber Security Centre (NCSC) has issued technical guidance following a series of cyber...

Claude AI Abused in Influence-as-a-Service Operations and Campaigns

Claude AI, developed by Anthropic, has been exploited by malicious actors in a range...

Threat Actors Attacking U.S. Citizens Via Social Engineering Attack

As Tax Day on April 15 approaches, a alarming cybersecurity threat has emerged targeting...