Pierluigi Paganini
July 29, 2023
The operators behind the Abyss Locker developed a Linux variant that targets VMware ESXi servers expanding their potential targets.
VMware ESXi servers are privileged targets of ransomware groups and are often part of enterprises’ infrastructures.
The Abyss Locker operation was launched early this year, like other ransomware groups, its operators implement a double-extortion model. At the time of this writing, the Tor leak site managed by the Abyss group lists 14 victim organizations.
Bleeping Computer reported that the researcher MalwareHunterTeam first discovered a Linux ELF encryptor for the Abyss ransomware that was designed to target VMware ESXi servers. Cybersecurity experts Michael Gillespie told BleepingComputer that the Abyss Locker Linux encryptor is based on the Hello Kitty ransomware.
The analysis of the encryptor code revealed that use of the ‘esxcli’ command-line VMware ESXi management tool enumerate virtual machines and terminate them.
Once the VM has been terminated, the malicious code can encrypt virtual disks (.vmdk), metadata (.vmsd), and snapshots (.vmsn).
The Abyss encryptor appends the .crypt extension to the filenames of the encrypted files and for each file creates a file with a .README_TO_RESTORE extension, which is the ransom note that contains the instructions for the negotiations.
Abyss Locker is the last operation in order of time that developed an encryptor to target VMware ESXi servers, other ransomware groups using Linux encryptors are AvosLocker, Black Basta, BlackMatter, HelloKitty, LockBit, Luna, RansomEXX, REvil, and Royal.
Follow me on Twitter: @securityaffairs Facebook and Mastodon
(SecurityAffairs – hacking, Abyss)
