Loading malware…
RTM Locker is a ransomware family reported targeting VMware ESXi servers and Linux environments. Multiple cited sources place it among the ransomware families that adopted Babuk-derived ESXi locker code following the 2021 leak of Babuk source code and builder components. SentinelLABS/Uptycs reporting specifically lists RTM Locker as a descendant or adopter of Babuk ESXi source code, and notes it as part of the wave of Babuk-based ESXi encryptors that emerged during H2 2022 and H1 2023. The available content indicates RTM Locker is associated with ESXi-focused ransomware activity rather than providing detailed sample-level behavior. It is also mentioned in broader 2023 ransomware trend reporting as one of the groups adding Linux variants. High-confidence context from the content therefore supports describing RTM Locker as a Babuk-derived or Babuk-influenced ransomware family used against VMware ESXi infrastructure, with Linux/ESXi targeting as its primary noted characteristic. No specific threat actor attribution, ransom note names, file extensions, cryptographic implementation details, or sample hashes are provided in the supplied content for RTM Locker.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family mentioned as part of the Babuk-descended ESXi locker ecosystem.
Ransomware referenced as adding Linux variants to expand attack surface.
A ransomware family observed adopting leaked Babuk code for ESXi encryption.
Ransomware targeting ESXi servers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.