Loading malware…
RTM Locker, also known as Read The Manual Locker, is a ransomware operation associated with a ransomware-as-a-service model. It has been observed deploying both Windows and Linux encryptors, including a Linux variant tailored to VMware ESXi environments where it targets virtual machines on hypervisors. Reporting also places RTM Locker among ransomware families that adopted Babuk-derived ESXi code, reflecting broader reuse of leaked ransomware source code to accelerate Linux and virtualization-focused development.
RTM Locker conducts double-extortion attacks, combining file encryption with theft of victim data for coercion. In Windows intrusions, the malware seeks administrative privileges, repeatedly prompting for elevation when necessary, then terminates selected processes and services, deletes shadow copies, clears event logs, and encrypts files across accessible local and remote volumes. It has also been observed mounting otherwise unmounted partitions to expand encryption coverage, using multithreaded encryption, changing the desktop wallpaper, and self-deleting after execution. In ESXi-focused attacks, the operation deploys a Linux encryptor specifically intended to impact virtualized enterprise infrastructure.
The malware’s behavior indicates deployment late in the intrusion lifecycle after attackers already possess substantial access to the victim environment. Successful compromises can affect enterprise data, including business records and credentials, and the operation threatens publication of stolen information if victims do not comply. RTM Locker has been described as opportunistic in victim selection for some campaigns, while the broader operation reportedly maintains affiliate rules and exclusions intended to reduce law-enforcement attention. The group has been linked to financially motivated cybercrime activity and has reportedly recruited affiliates, including individuals associated with other major ransomware ecosystems.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
We can see the number of external-facing ESXi hosts looking at Shodan.
Mitre Methodologies Execution Technique: T1106 – Native API
Technique ID Technique Description T1134.2 Access Token Manipulation: Create Process with Token The locker elevates its privilege using the “runas” token
Defense Evasion Techniques: T1070.004 – Indicator Removal: File Deletion
Technique ID Technique Description T1134.2 Access Token Manipulation: Create Process with Token The locker elevates its privilege using the “runas” token
...create Linux encryptors targeting VMware ESXi servers.
The one-but-last action the locker performs wipes the System, Application, and Security logs from the machine.
Technique ID Technique Description T1057 Process Discovery Checks which processes are running, and shuts down unwanted processes
...create Linux encryptors targeting VMware ESXi servers.
Collection Technique: T1005 – Data from Local System
Technique ID Technique Description T1486 Data Encrypted for Impact Encrypts the files on the disk
Impact Techniques: T1489 – Service Stop
Prior to starting the encryption process, the locker empties the recycle bin... and it deletes the shadow copies.
52 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.