The operators behind the Abyss Locker developed a Linux variant that targets VMware ESXi servers expanding their potential targets.
VMware ESXi servers are privileged targets of ransomware groups and are often part of enterprises’ infrastructures.
The Abyss Locker operation was launched early this year, like other ransomware groups, its operators implement a double-extortion model. At the time of this writing, the Tor leak site managed by the Abyss group lists 14 victim organizations.
Bleeping Computer reported that the researcher MalwareHunterTeam first discovered a Linux ELF encryptor for the Abyss ransomware that was designed to target VMware ESXi servers. Cybersecurity experts Michael Gillespie told BleepingComputer that the Abyss Locker Linux encryptor is based on the Hello Kitty ransomware.
The analysis of the encryptor code revealed that use of the ‘esxcli’ command-line VMware ESXi management tool enumerate virtual machines and terminate them.
Once the VM has been terminated, the malicious code can encrypt virtual disks (.vmdk), metadata (.vmsd), and snapshots (.vmsn).
The Abyss encryptor appends the .crypt extension to the filenames of the encrypted files and for each file creates a file with a .README_TO_RESTORE extension, which is the ransom note that contains the instructions for the negotiations.
Abyss Locker is the last operation in order of time that developed an encryptor to target VMware ESXi servers, other ransomware groups using Linux encryptors are AvosLocker, Black Basta, BlackMatter, HelloKitty, LockBit, Luna, RansomEXX, REvil, and Royal.
Follow me on Twitter: @securityaffairs Facebook and Mastodon
(SecurityAffairs – hacking, Abyss)
Two high-severity flaws in PHP Composer could let attackers run arbitrary commands via malicious repository…
Microsoft Patch Tuesday security updates for April 2026 fixed 165 vulnerabilities, including an actively exploited…
A breach at Basic-Fit exposed data of 1M members, including names, birth dates and bank…
US, UK and Canada ran Operation Atlantic, uncovering $45M in crypto theft and freezing $12M…
Leak of 8.1GB data tied to Rockstar Games includes anti-cheat code, game data, analytics and…
A critical RCE flaw, tracked as CVE-2025-0520, in ShowDoc is being actively exploited, putting unpatched…
This website uses cookies.