KOK08 is a Matrix-family strain. It replaces each file name with an operator mailbox in square brackets followed by a random string, then adds .KOK08; some earlier samples ended in .KOK8 instead. An RTF demand file carrying the KOK08 name is dropped beside the encrypted data. Encryption combines AES with RSA, and the note gives a seven-day window before the key is said to be destroyed, asking the victim to mail an ID to several addresses. It surfaced in September 2018 as one of many Matrix spin-offs. No data theft is described.
Sources: In-house research
File extensions: .KOK08
Ransom note filenames: !README_KOK08!.rtf
Contact addresses: kok08[@]protonmail[.]com, kok08[@]qq[.]com, kok8[@]tutanota[.]com
Decryptor: We checked the public decryptor listings on 2026-10-26 and could not confirm whether one exists.
Data exfiltration risk: Undocumented — Write-ups describe encryption with an email-only demand; no leak site or theft claim is linked to KOK08.
Systems typically targeted: Windows computers
Do this first: Keep the KOK08 RTF note and an encrypted sample, and record the mailbox shown in the renamed files before changing anything.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161