In the constantly evolving world of ransomware, a new and unusual variation has emerged. Rather than demanding cryptocurrency payments, certain threat actors are now instructing victims to make donations to charity in exchange for decryption keys or promises not to publish stolen data. These so-called donation-model ransomware groups present themselves as ideologically driven, often citing anti-corporate motives or positioning their activity as a form of digital protest.
This article explores the rise of donation-themed ransomware, with a particular focus on MalasLocker, and compares it with other groups adopting similar messaging. We assess whether these actors represent a genuine ideological shift or simply a new tactic to manipulate victims and public perception.
What Is Donation-Model Ransomware?
Donation-model ransomware refers to extortion operations in which the attacker, after encrypting files or stealing data, requests that the victim donate a specified amount to a registered charity. The victim is then asked to submit proof of donation—such as a receipt or transaction confirmation—in lieu of a traditional ransom payment.
The apparent goals of these campaigns vary. Some actors cite political or ideological motives, others claim to be exposing corporate neglect, while a few remain ambiguous, possibly to mask a more opportunistic approach.
Despite the unconventional demands, the impact of these campaigns can be as disruptive as any standard ransomware operation.
MalasLocker: The Most Notable Example
MalasLocker, active since 2023, is the clearest example of a donation-themed ransomware actor. The group primarily targets Zimbra email servers, exploiting known vulnerabilities to gain access and exfiltrate data.
Key characteristics of MalasLocker include:
- Selective encryption of user data, primarily email stores
- Ransom notes asking for donations to charities of the victim’s choice
- Instructions to provide proof of donation (e.g. screenshots or receipts)
- No cryptocurrency payment addresses or wallets
- Occasional public leaks of stolen data when victims do not comply
The group’s messages are often written in a casual tone and include references to moral judgement and “doing the right thing.” However, their public-facing leak site and data exposure practices remain consistent with traditional extortion tactics.
Other Threat Actors with Similar Motifs
Although MalasLocker is the most visible, other actors have experimented with similar messaging:
GoodWill Ransomware
An Indian ransomware variant identified in 2022, GoodWill encrypts data and demands that the victim perform acts of kindness, such as donating clothes or feeding the poor. Victims are asked to record videos of their charitable deeds as proof.
While arguably theatrical, GoodWill still causes system disruption and data loss, and no evidence exists that these attacks have genuinely improved social conditions.
Militant-themed Leak Channels
Some Telegram-based groups involved in data leaks (but not necessarily encryption) have encouraged donations to political causes. These are typically used to signal ideological alignment rather than enforce compliance through extortion.
Are These Truly Ethical Hackers?
Donation-model ransomware groups often position themselves as morally superior to financially motivated attackers. However, this framing is misleading. Regardless of the stated cause, victims still suffer data loss, operational downtime, reputational harm, and legal exposure.
Key concerns include:
- Data protection violations: Even if payment is avoided, stolen data may contain personal or sensitive information, triggering GDPR or compliance obligations.
- Lack of accountability: Threat actors remain anonymous and untraceable. There is no guarantee that data will be deleted after a donation is made.
- Coercion is still coercion: Demanding payment—charitable or otherwise—under threat of data exposure remains extortion by definition.
- Potential legal risk: In some jurisdictions, making a payment under duress to satisfy a criminal demand, even for charity, may carry regulatory implications.
Defensive Recommendations
Organisations can protect themselves from these and similar groups by applying the same principles used against other forms of ransomware and data theft:
- Patch vulnerable services such as Zimbra, particularly public-facing portals
- Limit admin access to known IP ranges and enforce strong authentication
- Monitor for signs of slow data exfiltration, archive creation, and outbound cloud connections
- Educate staff on credential security and safe administration practices
- Establish incident response playbooks that include non-traditional extortion scenarios
Maintaining backups and securing identity infrastructure are still essential safeguards, even when the attack doesn’t involve encryption.
Conclusion
Donation-based ransomware may present itself as ethically motivated, but the underlying tactics remain coercive and harmful. Groups like MalasLocker exploit vulnerabilities, extract sensitive data, and apply pressure to their victims under the guise of charity.
While these attacks may seem novel, they are part of a broader trend in which threat actors adapt their messaging to appeal to public sentiment or reduce scrutiny. Organisations must continue to treat such incidents as serious threats and respond accordingly.
