Loading story…
Ransomware operators expanded Linux tooling to hit virtualization and storage infrastructure, with REvil and DarkSide both deploying ELF-based encryptors aimed at VMware ESXi hosts and NAS devices. Researchers linked REvil’s Linux samples to the group’s Windows operation through shared configuration traits, including a common RaaS affiliate ID and similarly encoded ransom notes, while noting that encrypting centralized hypervisors and storage can cause disproportionate disruption across enterprise environments.
Analysis of DarkSide’s Linux variant showed malware tailored for ESXi environments, including enumeration of host, storage, and vSAN details, termination of running virtual machines, and encryption of files under paths such as /vmfs/volumes/. The malware used ChaCha20 with RSA-4096, appended extensions such as .darkside, dropped darkside_readme.txt, and sent victim information to hard-coded command-and-control servers via HTTP POST. Separate tooling also emerged to extract and decode embedded configuration data from Linux REvil samples, exposing fields such as public keys, affiliate identifiers, campaign IDs, ransom-note filenames, and encrypted file extensions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
A GitHub project named REconfig-linux was published to extract and decode embedded configuration data and ransom notes from ELF samples of the Linux REvil variant. The tool documented known configuration keys and stated it had been tested against four malware samples.
Threatpost reported that REvil operators had ported their ransomware to Linux to support targeted attacks against VMware ESXi environments and NAS devices. The report highlighted the operational impact of encrypting centralized VM storage and network-attached storage.
Trend Micro documented a Linux variant of DarkSide ransomware that targets VMware ESXi hosts and virtual machine-related files, including killing running VMs before encrypting data. The analysis also published technical details such as encryption behavior, C2 infrastructure, and sample hashes.
Alien Labs researcher Ofer Caspi said the Linux variant of REvil was spotted in May affecting Unix-like systems and VMware ESXi environments. This established that the Linux port was already being used in the wild.
AdvIntel reported in early May 2021 that REvil intended to port its Windows-based ransomware to Linux, indicating planned expansion beyond Windows targets.
The AlienVault reference states that DarkSide's developers announced they would be closing operations shortly after the Colonial Pipeline incident. This marked a major operational change for the ransomware-as-a-service group.
AT&T Cybersecurity's Alien Labs confirmed four Linux REvil samples after receiving a tip from MalwareHuntingTeam. The samples were described as ELF-64 executables sharing configuration traits and a RaaS affiliate ID with Windows REvil variants.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
otx.alienvault.com
Open sourcegithub.com
Open sourcethreatpost.com
Open sourcetrendmicro.com
Open sourcecybersecurity.att.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly identified ransomware operation known as **RedAlert**, also referenced internally as **N13V**, has been observed targeting corporate networks by encrypting both **Windows** systems and **Linux-based VMware ESXi** servers. The Linux variant is built specifically for ESXi environments and can forcibly shut down running virtual machines before encrypting VM-related files, while encrypted data is renamed with a `.crypt[number]` extension and accompanied by a `HOW_TO_RESTORE` ransom note containing a Tor payment link. Researchers reported that the malware uses the **NTRUEncrypt** public-key algorithm and already shows relatively mature cross-platform capabilities despite appearing to be a newer operation. RedAlert is also conducting **double-extortion** attacks, stealing data before encryption and threatening to publish it on a leak site if victims refuse to pay. Reporting on broader ransomware trends placed RedAlert alongside newer groups such as **0mega** and **Lilith**, underscoring a rise in emerging crews with increasingly capable tooling. In that wider landscape, RedAlert stood out for its focus on enterprise virtualization infrastructure, especially ESXi hosts, adding to concerns that ransomware operators are continuing to prioritize high-impact targets that can disrupt large numbers of systems at once.
Aug 15, 2026
**AvosLocker**, a ransomware-as-a-service operation first identified targeting Windows systems, expanded to Linux with an ELF-based variant designed to hit **VMware ESXi** servers and disrupt virtualized environments. Reporting on the malware shows it was distributed through spam campaigns and exploitation of Microsoft Exchange **ProxyShell**-related flaws, then paired encryption with data theft and victim extortion through Tor-based leak sites and an affiliate program. The Linux strain, often called **Avoslinux**, accepts command-line parameters for thread count and target directories, checks for ESXi-related paths, and attempts to stop running virtual machines before encrypting files and appending the `.avoslinux` extension. Technical analyses describe the Linux payload as a comparatively simple binary that prioritizes VM-related files such as `.vmdk` and `.vmem`, can invoke `esxcli` to kill active VMs, and may encrypt nearly all files on a host, including system files. Researchers found that the Linux variant uses embedded elliptic-curve cryptography with per-file symmetric keys and encrypted metadata appended to each file, while the Windows branch uses different routines including multithreading, network share enumeration, exclusion logic, and encryption that appends the `.avos2` extension before dropping a ransom note. The combined findings show AvosLocker deliberately adapted its tooling to maximize impact against both traditional Windows networks and ESXi-based virtualization infrastructure.
Aug 15, 2026
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026