Loading malware…
Cheerscrypt is a Linux-based ransomware family that targets VMware ESXi hypervisors. First observed in 2022, it is derived from the leaked Babuk source code, with especially strong similarities to Babuk’s ESXi-focused encryptor, but includes operator-specific modifications. It has been used in attacks against ESXi environments, where compromising a single hypervisor can disrupt many hosted virtual machines and associated enterprise services at once.
Cheerscrypt is designed to encrypt VMware-related data on ESXi systems, including virtual disk, memory, snapshot, swap, and log files. Before encryption, it issues ESXi management commands to forcibly terminate running virtual machine processes so that locked VM files can be accessed and encrypted successfully. It requires a target path as input, processes files within that scope, renames encrypted files with a dedicated extension, and drops a ransom note in affected directories. Console output may be displayed at the end of execution to summarize the encryption routine.
The malware uses the Sosemanuk stream cipher for file encryption, with per-file keys derived through elliptic-curve Diffie-Hellman. It generates ephemeral key material locally using Linux randomness sources and combines that material with an embedded public key controlled by the operator, enabling only the threat actor to recover the corresponding decryption secret. This design means decryption depends on access to the attacker-held private key.
Cheerscrypt has been associated with double-extortion ransomware operations, combining file encryption with additional coercive pressure on victims. Its focus on ESXi infrastructure makes it particularly relevant to enterprise environments that rely on server virtualization and centralized virtual machine hosting.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Successfully encrypted files are renamed with the .Cheers extension. However, the ransomware first renames the files it will encrypt before encrypting the files. | It seeks out log files and VMware-related files with the following extensions: .log, .vmdk, .vmem, .vswp, .vmsn
Before the file encryption starts, AvosLocker shuts down the ESXi virtual machines using the esxcli command-line utility.
Upon execution, it implements the following command to terminate VM processes using ESXCLI: “esxcli vm process kill –type=force –world-id=$(esxcli vm process list|grep ‘World ID’|awk ‘{print $3}’)” The termination of the VM processes ensures that the ransomware can successfully encrypt VMware-related files.
For example, -w parameter can be used to stop all running virtual machines with the help of the esxcli command-line utility
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware referenced as targeting VMware ESXi servers.
Ransomware derived from Babuk ESXi code that shuts down VMs via esxcli, encrypts with Sosemanuk and ECDH, and appends .Cheers.
Linux-based ransomware targeting VMware ESXi servers. It kills VM processes, encrypts VMware-related files, appends the .Cheers extension, drops a ransom note named "How to Restore Your Files.txt," and uses a double-extortion scheme.
Ransomware using Sosemanuk stream cipher with ECDH-derived keys.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.