Loading threat actor…
SEXi, also referred to as the SEXi ransomware group and later rebranded as APT INC, is a financially motivated ransomware operation known for targeting VMware ESXi environments. The group has been associated with attacks against organizations running unsupported ESXi versions and uses separate encryptors for different platforms: a Linux/ESXi payload derived from leaked Babuk source code and a Windows payload derived from leaked LockBit source code. This platform-specific use of leaked ransomware families reflects an opportunistic operating model that lowers development overhead while preserving cross-platform impact. SEXi is notable for focusing on virtualization infrastructure, particularly ESXi servers, which can amplify operational disruption by affecting multiple hosted workloads at once. Reported intrusions indicate the group has targeted both ESXi and Windows systems within victim environments. Its ransom operations have used the Session messaging platform for victim communications rather than a dedicated leak site, and reporting has linked reuse of the same Session identifier across incidents. The group has been described as less operationally mature than top-tier ransomware programs, but still capable of causing significant business disruption through effective use of proven leaked encryptors. By mid-2024, SEXi was reported to have rebranded as APT INC while continuing the same general pattern of attacks against VMware ESXi infrastructure. APT INC has been linked to continued use of Babuk- and LockBit-based encryptors and to ongoing assaults on organizations with exposed or vulnerable virtualization assets. The actor is best characterized as a ransomware/extortion threat focused on virtualized enterprise infrastructure for financial gain.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware group mentioned as using the Session messaging service in attacks.
Ransomware group focused primarily on ESXi environments, deploying separate Linux and Windows variants built from leaked Babuk and LockBit code. The group appears comparatively unprofessional and uses Session for victim contact instead of a TOR leak site.
SEXi Ransomware Group (now APT INC) targets VMware ESXi servers and Windows systems using Babuk and LockBit 3 encryptors, demanding ransoms and encrypting data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.