HelloKitty lacks the stealth of Ryuk, REvil and Conti, but has still struck some notable targets, including CEMIGO. Ransomware overview and IoCs here.

Updated samples indicate access to original source code and active development, signaling that GOLD SOUTHFIELD has resumed operations.