Loading story…
Kaspersky reported that the Luna and Black Basta ransomware families rapidly advanced the trend toward cross-platform attacks, with both strains capable of targeting virtualized environments. Luna, written in Rust, was observed running on Windows, Linux, and ESXi and using an uncommon x25519 + AES encryption scheme, while its operators appeared to limit participation to Russian-speaking affiliates.
Black Basta, a newer C++ ransomware family, was described as maturing quickly and adding capabilities such as safe-mode reboot to improve execution and evade defenses. Kaspersky said the group had already claimed more than 40 victims across multiple sectors and regions, and noted that its Linux variant focused primarily on ESXi systems, reflecting a broader criminal shift toward encrypting virtualization infrastructure to maximize operational disruption.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By April 2022, Black Basta had added functionality to reboot infected Windows systems into safe mode before encryption and introduced persistence behavior mimicking Windows Services. Kaspersky noted these changes as signs of the ransomware's rapid maturation.
Black Basta first came to light in February 2022. At that stage, its malware, infrastructure, and campaign were still under development, with a victim website available but its victim blog not yet online.
Kaspersky analyzed a Linux version of Black Basta that was specifically designed to target ESXi systems, while also being capable of encrypting general Linux systems. The variant defaults to encrypting the /vmfs/volumes folder when no arguments are provided and uses ChaCha20 with multithreading to speed encryption.
Kaspersky analyzed Luna samples obtained via the Kaspersky Security Network and found the ransomware runs on Windows, Linux, and ESXi. The company also assessed with medium confidence that the operators are Russian speakers based on spelling mistakes in the embedded ransom note.
Kaspersky observed a new ransomware advertisement for Luna on a darknet ransomware forum. The advertisement stated that Luna worked only with Russian-speaking affiliates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BlackSuit ransomware has emerged as a cross-platform threat targeting **Windows**, **Linux**, and **VMware ESXi** environments, with researchers documenting separate Windows and Linux samples and noting code similarities to **Royal ransomware**. The malware encrypts files with **AES**, drops ransom notes with payment instructions and a **Tor** contact link, and appears designed to support enterprise-impacting attacks across mixed operating environments. On Windows, BlackSuit supports victim identification, mutex-based single-instance execution, network share enumeration, shadow copy deletion, safe boot modification, self-deletion, and host profiling consistent with **MITRE ATT&CK `T1082` (System Information Discovery)**. On Linux, the ELF variant can terminate VMware-related services such as `vmsyslog`, shut down active virtual machines, and optionally focus encryption on VMware-associated files, indicating a deliberate effort to maximize disruption in virtualized infrastructure before encrypting data.
Aug 15, 2026
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026
A newly identified ransomware operation known as **RedAlert**, also referenced internally as **N13V**, has been observed targeting corporate networks by encrypting both **Windows** systems and **Linux-based VMware ESXi** servers. The Linux variant is built specifically for ESXi environments and can forcibly shut down running virtual machines before encrypting VM-related files, while encrypted data is renamed with a `.crypt[number]` extension and accompanied by a `HOW_TO_RESTORE` ransom note containing a Tor payment link. Researchers reported that the malware uses the **NTRUEncrypt** public-key algorithm and already shows relatively mature cross-platform capabilities despite appearing to be a newer operation. RedAlert is also conducting **double-extortion** attacks, stealing data before encryption and threatening to publish it on a leak site if victims refuse to pay. Reporting on broader ransomware trends placed RedAlert alongside newer groups such as **0mega** and **Lilith**, underscoring a rise in emerging crews with increasingly capable tooling. In that wider landscape, RedAlert stood out for its focus on enterprise virtualization infrastructure, especially ESXi hosts, adding to concerns that ransomware operators are continuing to prioritize high-impact targets that can disrupt large numbers of systems at once.
Aug 15, 2026