The latest ransomware operation to target Linux devices is Royal Ransomware. It is specifically designed to encrypt VMware ESXi virtual machines. Other ransomware gangs, such as Black Basta, LockBit, BlackMatter, AvosLocker, REvil, HelloKitty, RansomEXX, and Hive, have also released Linux encryptors. The new Royal Ransomware variant was discovered by Will Thomas of the Equinix Threat Analysis Center and is executed using the command line. It adds the .Royal u extension to all encrypted files on the VM. Anti-malware solutions have had difficulty detecting Royal Ransomware samples, but they are now detected by 23 out of 62 malware scanning engines on VirusTotal. Royal Ransomware is a private operation made up of experienced threat actors who previously worked with the Conti ransomware operation. They began malicious activities in September after first being spotted in January 2022. Initially, they used encryptors from other operations, such as BlackCat, but then transitioned to using their own, starting with Zeon. The group rebranded as Royal and began deploying a new encryptor in attacks that produces ransom notes with the same name. The gang demands ransom payments ranging from $250,000 to tens of millions after encrypting their targets enterprise network systems. In December, the U.S. Department of Health and Human Services warned of Royal ransomware attacks targeting organizations in the Healthcare and Public Healthcare sector. The ransomware group's shift towards targeting ESXi virtual machines is due to the fact that enterprises have transitioned to VMs as they come with improved device management and much more efficient resource handling. After deploying their payloads on ESXi hosts, the ransomware operators use a single command to encrypt multiple servers. ESXiArgs, a new ransomware strain, was used to scan for and encrypt unpatched servers in a massive campaign targeting ESXi devices worldwide this Friday. Over 100 servers worldwide were compromised in these attacks within just a few hours, according to a Shodan search.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 06 Feb 2023 02:45:03 +0000