AvosLocker expands its targets by implementing the support for encrypting Linux systems, specifically VMware ESXi servers, Bleeping computed reported.
“While we couldn’t find what targets were attacked using this AvosLocker ransomware Linux variant, BleepingComputer knows of at least one victim that got hit with a $1 million ransom demand.” reported BleepingComputer. Security researcher MalwareHunterTeam confirmed that the ransomware gang is using the Linux encryptor since November 2021.
Other ransomware operations supporting Linux and ESXi servers are RansomExx/Defray, Mespinoza, HelloKitty, and Babuk. Linux-based versions of popular ransomware allow gangs to target a broad range of organizations, especially those using ESXi servers.
AvosLocker operators already advertised in the past a Linux variant, dubbed AvosLinux, of their malware claiming it was able to support Linux and ESXi servers.
According to BleepingComputer, upon execution AvosLinux terminates all ESXi machines on the server then it starts encrypting files.
The AvosLocker ransomware appends the .avoslinux extension to the filenames of all the encrypted files, then drops ransom notes in each folder containing the encrypted files.
The AvosLocker ransomware-as-a-service recently emerged in the threat landscape and its attacks surged between November and December. In a recent wave of attacks, AvosLocker ransomware is rebooting systems into Windows Safe Mode to disable endpoint security solutions.
At the end of December, the AvosLocker ransomware operators released a free decryptor after they accidentally encrypted the system of US Government entity.
Follow me on Twitter: @securityaffairs and Facebook
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, AvosLocker)
[adrotate banner=”5″]
[adrotate banner=”13″]
D-Link fixed multiple critical flaws in its WiFi 6 routers that allow remote attackers to…
Microsoft warns that a recently patched Windows flaw, tracked as CVE-2024-43461, was actively exploited as…
SolarWinds addressed a critical remote code execution vulnerability, tracked as CVE-2024-28991, in Access Rights Manager.…
Apple drops its lawsuit against commercial spyware vendor NSO Group, due to the risk of…
A hacker tricked ChatGPT into providing instructions to make homemade bombs demonstrating how to bypass…
Port of Seattle confirmed on Friday that the Rhysida ransomware group was behind the cyberattack…
This website uses cookies.