The HelloKitty ransomware organization, also referred to as FiveHands and DeathRansom, has expanded their extortion techniques to now include distributed denial-of-service (DDoS) attacks. By definition, a DDoS attack occurs when legitimate users are unable to access information systems, devices, websites, or other network resources due to the actions of a malicious actor, commonly flooding the target infrastructure with an enormous number of requests until the systems don’t respond. Typically, the group will utilize this tactic to shut down any official websites belonging to the victim should they refuse to pay any ransom. Primarily, HelloKitty targets victims in order to exfiltrate sensitive documents and confidential information prior to encrypting the entire system, therefore they have “proof-of-life” as well as additional leverage to utilize in negotiations. Key attacks from the group include CD Projekt Red, where several game source codes were stolen, alongside several attacks against Linux servers and ESXi virtual machines. CTAPT will continue to track HelloKitty operations and provide updates as deemed necessary.