Stefan Mileschin

Targets VMware ESXi servers

Researchers at Trend Micro have discovered some new Linux-based ransomware that's being used to attack VMware ESXi servers.

For those not in the know, ESXi servers are bare-metal hypervisors for creating and running several virtual machines that share the same hard drive storage.

Dubbed Cheerscrypt, the bad app is following in the footsteps of other ransomware programs — such as LockBit, Hive, and RansomEXX — that have found ESXi an efficient way to infect many computers at once with malicious payloads.

Roger Grimes, a defense evangelist with security awareness training provider KnowBe4, said that most organisations operate using VMware virtual machines. "It makes the job of ransomware attackers far easier because they can encrypt one server — the VMware server — and then encrypt every guest VM it contains. One compromise and encryption command can easily encrypt dozens to hundreds of other virtually run computers all at once."

https://fudzilla.com/news/54928-tren...sed-ransomware