Loading story…
Trend Micro reported that the Linux-based Cheerscrypt ransomware has been used in attacks against VMware ESXi servers, underscoring continued criminal focus on hypervisors that can disrupt many virtual machines at once. Researchers said the malware appears to be derived from the leaked Babuk source code—especially its ESXi-oriented Linux variant—but was modified for the operator’s own campaign and paired with a double-extortion approach.
The malware requires a target path as input, forcibly stops virtual machine processes with esxcli so VMware-related files can be encrypted, appends the .Cheers extension to locked files, and drops a ransom note titled "How to Restore Your Files.txt". Trend Micro said Cheerscrypt uses the SOSEMANUK stream cipher and generates per-file keys through ECDH with an embedded public key and randomness from /dev/urandom, highlighting a technically adapted ransomware strain built specifically to maximize impact on virtualized infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro reported on a Linux-based ransomware family named Cheerscrypt that had been observed in multiple attacks against VMware ESXi servers. The analysis said the malware was derived from the leaked Babuk ESXi/Linux source code and customized for the operator's objectives.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**AvosLocker**, a ransomware-as-a-service operation first identified targeting Windows systems, expanded to Linux with an ELF-based variant designed to hit **VMware ESXi** servers and disrupt virtualized environments. Reporting on the malware shows it was distributed through spam campaigns and exploitation of Microsoft Exchange **ProxyShell**-related flaws, then paired encryption with data theft and victim extortion through Tor-based leak sites and an affiliate program. The Linux strain, often called **Avoslinux**, accepts command-line parameters for thread count and target directories, checks for ESXi-related paths, and attempts to stop running virtual machines before encrypting files and appending the `.avoslinux` extension. Technical analyses describe the Linux payload as a comparatively simple binary that prioritizes VM-related files such as `.vmdk` and `.vmem`, can invoke `esxcli` to kill active VMs, and may encrypt nearly all files on a host, including system files. Researchers found that the Linux variant uses embedded elliptic-curve cryptography with per-file symmetric keys and encrypted metadata appended to each file, while the Windows branch uses different routines including multithreading, network share enumeration, exclusion logic, and encryption that appends the `.avos2` extension before dropping a ransom note. The combined findings show AvosLocker deliberately adapted its tooling to maximize impact against both traditional Windows networks and ESXi-based virtualization infrastructure.
Aug 15, 2026
A newly identified ransomware operation known as **RedAlert**, also referenced internally as **N13V**, has been observed targeting corporate networks by encrypting both **Windows** systems and **Linux-based VMware ESXi** servers. The Linux variant is built specifically for ESXi environments and can forcibly shut down running virtual machines before encrypting VM-related files, while encrypted data is renamed with a `.crypt[number]` extension and accompanied by a `HOW_TO_RESTORE` ransom note containing a Tor payment link. Researchers reported that the malware uses the **NTRUEncrypt** public-key algorithm and already shows relatively mature cross-platform capabilities despite appearing to be a newer operation. RedAlert is also conducting **double-extortion** attacks, stealing data before encryption and threatening to publish it on a leak site if victims refuse to pay. Reporting on broader ransomware trends placed RedAlert alongside newer groups such as **0mega** and **Lilith**, underscoring a rise in emerging crews with increasingly capable tooling. In that wider landscape, RedAlert stood out for its focus on enterprise virtualization infrastructure, especially ESXi hosts, adding to concerns that ransomware operators are continuing to prioritize high-impact targets that can disrupt large numbers of systems at once.
Aug 15, 2026
Rapid7 reported that a **Kyber ransomware** affiliate deployed two distinct payloads in the same March 2026 intrusion, targeting both **VMware ESXi** infrastructure and **Windows file servers** to maximize operational disruption. The ESXi variant encrypted VMware datastore files, could optionally terminate virtual machines, and defaced SSH and web management interfaces with ransom notes. The Windows variant targeted core file systems and added broader impact features, including killing backup-, database-, and IIS-related services, deleting shadow copies, disabling recovery options, clearing event logs, and testing an experimental **Hyper-V** shutdown capability. The two samples shared the same campaign ID and **Tor-based** negotiation and leak infrastructure, linking them to the same affiliate, but their internals differed sharply. Rapid7 found the ESXi payload falsely advertised post-quantum protection with `Kyber1024`; in practice, it used **ChaCha8** with **RSA-4096** key wrapping. By contrast, the Windows variant, written in **Rust**, appeared to implement the claimed hybrid scheme using **AES-256-CTR**, `Kyber1024`, and **X25519**. Public reporting indicates the group remains relatively new, with limited prior technical analysis and only one victim publicly listed on its extortion site: a large U.S. defense contractor and IT services provider.
Jun 29, 2026