The operators behind the Abyss Locker developed a Linux variant that targets VMware ESXi servers expanding their potential targets.
VMware ESXi servers are privileged targets of ransomware groups and are often part of enterprises’ infrastructures.
The Abyss Locker operation was launched early this year, like other ransomware groups, its operators implement a double-extortion model. At the time of this writing, the Tor leak site managed by the Abyss group lists 14 victim organizations.
Bleeping Computer reported that the researcher MalwareHunterTeam first discovered a Linux ELF encryptor for the Abyss ransomware that was designed to target VMware ESXi servers. Cybersecurity experts Michael Gillespie told BleepingComputer that the Abyss Locker Linux encryptor is based on the Hello Kitty ransomware.
The analysis of the encryptor code revealed that use of the ‘esxcli’ command-line VMware ESXi management tool enumerate virtual machines and terminate them.
Once the VM has been terminated, the malicious code can encrypt virtual disks (.vmdk), metadata (.vmsd), and snapshots (.vmsn).
The Abyss encryptor appends the .crypt extension to the filenames of the encrypted files and for each file creates a file with a .README_TO_RESTORE extension, which is the ransom note that contains the instructions for the negotiations.
Abyss Locker is the last operation in order of time that developed an encryptor to target VMware ESXi servers, other ransomware groups using Linux encryptors are AvosLocker, Black Basta, BlackMatter, HelloKitty, LockBit, Luna, RansomEXX, REvil, and Royal.
Follow me on Twitter: @securityaffairs Facebook and Mastodon
(SecurityAffairs – hacking, Abyss)
The DoJ charged Anonymous Sudan members and disrupted their DDoS infrastructure, halting its cyber operations.…
Russia-linked threat actor RomCom targeted Ukrainian government agencies and Polish entities in cyber attacks since…
A critical flaw in Kubernetes Image Builder could allow attackers to gain root access if…
VMware fixes a high-severity SQL injection flaw in HCX allowing non-admin users to remotely execute…
Brazil's Polícia Federal has arrested hacker USDoD, the hacker behind the National Public Data and…
Finnish Customs shut down the Tor darknet marketplace Sipulitie and seized the servers hosting the…
This website uses cookies.