Loading threat actor…
Rorschach, also referred to as BabLock, is a ransomware family/operator identified in reporting on VMware ESXi-targeting ransomware derived from the leaked 2021 Babuk source code. SentinelLABS listed Rorschach aka BabLock among the ransomware families that adopted Babuk-based ESXi encryptors beginning in H2 2022, and separate reporting noted that new ESXi-focused ransomware such as Rorschach is related to adoption of the leaked Babuk ransomware code. Based on the provided content, Rorschach is associated with Linux/VMware ESXi ransomware activity rather than a nation-state actor. The content does not provide additional high-confidence details on specific victim sectors, geography, intrusion methods, or subgroup structure beyond the alias BabLock and its inclusion among Babuk-descended ESXi ransomware families.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named ransomware family/group cited as a Babuk ESXi source-code descendant.
Named as an ESXi-focused ransomware family/operator in the context of Babuk code reuse (attribution/relationship not further detailed).
Ransomware family observed using leaked Babuk source code/builder to create ESXi encryptors.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.