PartyTicket
Aliases: Elections GoRansom, HermeticRansom, SonicVote
- First seen
- 2022-02-23 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 12:44:10
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:ua
Context
PartyTicket is a Go-written ransomware, which was described as a poorly designed one by Zscaler. According to Brett Stone-Gross this malware is likely intended to be a diversion from the Hermetic wiper (aka. KillDisk.NCV, DriveSlayer) attack.
Reports & references
- services.google.com — Google Fog Of War Research Report (report)
- services.google.com — Apt44 Unearthing Sandworm (report)
- Microsoft — Analysis Resources Cyber Threat Activity Ukraine (report)
- Mandiant — Russia Invasion Ukraine Retaliation (report)
- Kaspersky — 106457 (report)
- Trend Micro — Ioc%20Resource%20For%20Russia Ukraine%20Conflict Related%20Cyberattacks 03032022 (report)
- trustwave.com — Overview Of The Cyber Weapons Used In The Ukraine Russia War (report)
- youtube.com — Watch (report)
- inquest.net — Ukraine Cyberwar Overview (report)
- mandiant.widen.net — M Trends 2023 (report)
- Microsoft — Re4Vwwd (report)
- Microsoft — A Year Of Russian Hybrid Warfare In Ukraine Ms Threat Intelligence 1 (report)
- Mandiant — Information Operations Surrounding Ukraine (report)
- splunk.com — Detecting Hermeticwiper (report)
- go.recordedfuture.com — Mtp 2022 0302 (report)
- kaspersky.com — 43825 (report)
- esentire.com — Esentire Threat Intelligence Malware Analysis Hermeticwiper Partyticket (report)
- Kaspersky — 106075 (report)
- ESET — Isaacwiper Hermeticwizard Wiper Worm Targeting Ukraine (report)
- brighttalk.com — 534324 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Partyticket (report)
- bleepingcomputer.com — Free Decryptor Released For Hermeticransom Victims In Ukraine (report)
- decoded.avast.io — Help For Ukraine Free Decryptor For Hermeticransom Ransomware (report)
- techtarget.com — Crowdstrike Cracks Partyticket Ransomware Targeting Ukraine (report)
- threatpost.com — 178762 (report)