Loading story…
A newly identified ransomware operation known as RedAlert, also referenced internally as N13V, has been observed targeting corporate networks by encrypting both Windows systems and Linux-based VMware ESXi servers. The Linux variant is built specifically for ESXi environments and can forcibly shut down running virtual machines before encrypting VM-related files, while encrypted data is renamed with a .crypt[number] extension and accompanied by a HOW_TO_RESTORE ransom note containing a Tor payment link. Researchers reported that the malware uses the NTRUEncrypt public-key algorithm and already shows relatively mature cross-platform capabilities despite appearing to be a newer operation.
RedAlert is also conducting double-extortion attacks, stealing data before encryption and threatening to publish it on a leak site if victims refuse to pay. Reporting on broader ransomware trends placed RedAlert alongside newer groups such as 0mega and Lilith, underscoring a rise in emerging crews with increasingly capable tooling. In that wider landscape, RedAlert stood out for its focus on enterprise virtualization infrastructure, especially ESXi hosts, adding to concerns that ransomware operators are continuing to prioritize high-impact targets that can disrupt large numbers of systems at once.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The report detailed Lilith as a 64-bit C/C++ console executable that terminates processes and services, enumerates drives and files, encrypts data, appends the .lilith extension, and drops Restore_Your_Files.txt ransom notes. It also noted the note gives victims three days to negotiate before threatening to leak personal data via an onion site and TOX contact.
Cyble published a report highlighting three newer ransomware threats—RedAlert, 0mega, and Lilith—as part of a broader rise in ransomware activity. The report characterized 0mega as a new double-extortion gang and Lilith as a new ransomware tool used by operators.
Analysis revealed RedAlert's Linux encryptor could forcibly stop running VMware ESXi virtual machines before encrypting VM-related files, used NTRUEncrypt, appended .crypt[number] to files, and dropped HOW_TO_RESTORE ransom notes. The reporting also described its double-extortion model, Tor payment site, and Monero payment demand.
A new ransomware operation called RedAlert, internally named N13V, was identified targeting corporate networks. Reporting noted it encrypted both Windows systems and Linux VMware ESXi servers and that its leak site listed only one victim at the time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026
Ransomware operators expanded Linux tooling to hit virtualization and storage infrastructure, with **REvil** and **DarkSide** both deploying ELF-based encryptors aimed at **VMware ESXi** hosts and NAS devices. Researchers linked REvil’s Linux samples to the group’s Windows operation through shared configuration traits, including a common RaaS affiliate ID and similarly encoded ransom notes, while noting that encrypting centralized hypervisors and storage can cause disproportionate disruption across enterprise environments. Analysis of DarkSide’s Linux variant showed malware tailored for ESXi environments, including enumeration of host, storage, and vSAN details, termination of running virtual machines, and encryption of files under paths such as `/vmfs/volumes/`. The malware used **ChaCha20** with **RSA-4096**, appended extensions such as `.darkside`, dropped `darkside_readme.txt`, and sent victim information to hard-coded command-and-control servers via HTTP POST. Separate tooling also emerged to extract and decode embedded configuration data from Linux REvil samples, exposing fields such as public keys, affiliate identifiers, campaign IDs, ransom-note filenames, and encrypted file extensions.
Aug 15, 2026
BlackSuit ransomware has emerged as a cross-platform threat targeting **Windows**, **Linux**, and **VMware ESXi** environments, with researchers documenting separate Windows and Linux samples and noting code similarities to **Royal ransomware**. The malware encrypts files with **AES**, drops ransom notes with payment instructions and a **Tor** contact link, and appears designed to support enterprise-impacting attacks across mixed operating environments. On Windows, BlackSuit supports victim identification, mutex-based single-instance execution, network share enumeration, shadow copy deletion, safe boot modification, self-deletion, and host profiling consistent with **MITRE ATT&CK `T1082` (System Information Discovery)**. On Linux, the ELF variant can terminate VMware-related services such as `vmsyslog`, shut down active virtual machines, and optionally focus encryption on VMware-associated files, indicating a deliberate effort to maximize disruption in virtualized infrastructure before encrypting data.
Aug 15, 2026