Loading story…
AvosLocker, a ransomware-as-a-service operation first identified targeting Windows systems, expanded to Linux with an ELF-based variant designed to hit VMware ESXi servers and disrupt virtualized environments. Reporting on the malware shows it was distributed through spam campaigns and exploitation of Microsoft Exchange ProxyShell-related flaws, then paired encryption with data theft and victim extortion through Tor-based leak sites and an affiliate program. The Linux strain, often called Avoslinux, accepts command-line parameters for thread count and target directories, checks for ESXi-related paths, and attempts to stop running virtual machines before encrypting files and appending the .avoslinux extension.
Technical analyses describe the Linux payload as a comparatively simple binary that prioritizes VM-related files such as .vmdk and .vmem, can invoke esxcli to kill active VMs, and may encrypt nearly all files on a host, including system files. Researchers found that the Linux variant uses embedded elliptic-curve cryptography with per-file symmetric keys and encrypted metadata appended to each file, while the Windows branch uses different routines including multithreading, network share enumeration, exclusion logic, and encryption that appends the .avos2 extension before dropping a ransom note. The combined findings show AvosLocker deliberately adapted its tooling to maximize impact against both traditional Windows networks and ESXi-based virtualization infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
VMware Security Blog published a technical analysis of AvosLocker's Linux variant, detailing its ESXi/VMFS targeting, VM shutdown behavior, encryption workflow, and ransom note. The post also released YARA detection logic, MITRE ATT&CK mappings, and file hashes for AvosLocker ELF samples and a decryptor.
The analyzed Avoslinux sample had been publicly available since January 2022. The Linux ransomware sample was later noted as found on MalwareBazaar.
AvosLocker operators announced a Linux variant of their ransomware in autumn 2021. The Linux branch was aimed at VMware ESXi environments.
AvosLocker was identified in 2021 as a ransomware-as-a-service operation. It initially targeted Windows systems before later expanding its tooling.
The reference states AvosLocker activity was observed in early July 2021, marking an early documented appearance of the ransomware family targeting business environments. The profile describes Windows-focused variants using AES-256 encryption and double-extortion style ransom demands.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
blog.lexfo.fr
Open sourceblog.qualys.com
Open sourceblogs.vmware.com
Open sourceblog.cyble.com
Open sourceid-ransomware.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026
Ransomware operators expanded Linux tooling to hit virtualization and storage infrastructure, with **REvil** and **DarkSide** both deploying ELF-based encryptors aimed at **VMware ESXi** hosts and NAS devices. Researchers linked REvil’s Linux samples to the group’s Windows operation through shared configuration traits, including a common RaaS affiliate ID and similarly encoded ransom notes, while noting that encrypting centralized hypervisors and storage can cause disproportionate disruption across enterprise environments. Analysis of DarkSide’s Linux variant showed malware tailored for ESXi environments, including enumeration of host, storage, and vSAN details, termination of running virtual machines, and encryption of files under paths such as `/vmfs/volumes/`. The malware used **ChaCha20** with **RSA-4096**, appended extensions such as `.darkside`, dropped `darkside_readme.txt`, and sent victim information to hard-coded command-and-control servers via HTTP POST. Separate tooling also emerged to extract and decode embedded configuration data from Linux REvil samples, exposing fields such as public keys, affiliate identifiers, campaign IDs, ransom-note filenames, and encrypted file extensions.
Aug 15, 2026
Trend Micro reported that the Linux-based **Cheerscrypt** ransomware has been used in attacks against VMware **ESXi** servers, underscoring continued criminal focus on hypervisors that can disrupt many virtual machines at once. Researchers said the malware appears to be derived from the leaked **Babuk** source code—especially its ESXi-oriented Linux variant—but was modified for the operator’s own campaign and paired with a **double-extortion** approach. The malware requires a target path as input, forcibly stops virtual machine processes with `esxcli` so VMware-related files can be encrypted, appends the `.Cheers` extension to locked files, and drops a ransom note titled **"How to Restore Your Files.txt"**. Trend Micro said Cheerscrypt uses the **SOSEMANUK** stream cipher and generates per-file keys through **ECDH** with an embedded public key and randomness from `/dev/urandom`, highlighting a technically adapted ransomware strain built specifically to maximize impact on virtualized infrastructure.
Aug 14, 2026