Credit: Dreamstime
Researchers at Trend Micro have discovered some new Linux-based ransomware that’s being used to attack VMware ESXi servers, a bare-metal hypervisor for creating and running several virtual machines (VMs) that share the same hard drive storage.
Called Cheerscrypt, the bad app is following in the footsteps of other ransomware programs—such as LockBit, Hive and RansomEXX—that have found ESXi an efficient way to infect many computers at once with malicious payloads.
Roger Grimes, a defence evangelist with security awareness training provider KnowBe4, explains that most of the world’s organisations operate using VMware virtual machines.
“It makes the job of ransomware attackers far easier because they can encrypt one server — the VMware server — and then encrypt every guest VM it contains. One compromise and encryption command can easily encrypt dozens to hundreds of other virtually run computers all at once.”
“Most VM shops use some sort of VM backup product to back up all guest servers, so finding and deleting or corrupting one backup repository kills the backup image for all the hosted guest servers all at once,” Grimes adds.
Cheerscrypt gang uses “double extortion”
The Trend Micro researchers— Arianne Dela Cruz, Byron Gelera, McJustine De Guzman, and Warren Sto. Tomas—explain in a company blog that after acquiring an input parameter specifying an encryption path, Cheerscrypt issues a command terminating all VM processes to make sure it can encrypt all VM-related files.
The gang behind Cheerscrypt uses a “double extortion” technique to extract money from its targets, the researchers explain. “Security Alert!!!” the attackers’ ransom message declares. “We hacked…
