Linux version of RTM Locker ransomware targets VMware ESXi servers

RTM Locker is the latest enterprise-targeting ransomware operation found to be deploying a Linux encryptor that targets virtual machines on VMware ESXi servers.

At the time, Trellix and MalwareHunterTeam had only seen a Windows ransomware encryptor, but as Uptycs reported yesterday, RTM has expanded its targeting to Linux and VMware ESXi servers.

Due to this, an organization’s servers are commonly spread over a mix of dedicated devices and VMware ESXi servers running multiple virtual servers.

In a new report by Uptycs, researchers analyzed a Linux variant of the RTM Locker that is based on the leaked source code of the now-defunct Babuk ransomware.

The RTM Locker Linux encryptor appears to be created explicitly for attacking VMware ESXi systems, as it contains numerous references to commands used to manage virtual machines.

The existence of an ESXi-targeting version is enough to categorize RTM Locker as a significant threat to the enterprise.

Partagez cet article sur les réseaux sociaux:

Subscribe to Our Newsletter!
Stay on top of cybersecurity risks, evolving threats and industry news.
This field is for validation purposes and should be left unchanged.

Les Dernières Nouvelles de Cybersécurité

Qu’il s’agisse de cyberattaques majeures, de vulnérabilités critiques récemment découvertes ou de bonnes pratiques de sécurité, lisez le ici en premier:

Tell us about your needs.
Get an answer the same business day.

Tell us about your needs.
Get an answer the same business day.

Fill out the form below and get an answer from our experts within 1 business day.

Got an urgent request? Call us at 1-877-805-7475 or Book a meeting.

PCI-DSS

What happens next:

  • We reach out to learn about your objectives
  • We work together to define your project's scope
  • You get an all-inclusive, no engagement proposal

This field is for validation purposes and should be left unchanged.
Scroll to Top

BOOK A MEETING

Enter Your
Corporate Email

This field is for validation purposes and should be left unchanged.
This site is registered on wpml.org as a development site.