Loading malware…
GoGoogle is a ransomware operation known to have developed a Linux encryptor for attacks against VMware ESXi environments. It is part of the broader shift among enterprise-focused ransomware groups toward Linux-based tooling designed to maximize impact in virtualized infrastructure, where compromising a single hypervisor can disrupt many hosted systems at once. Available reporting supports GoGoogle’s use of a Linux encryptor specifically associated with ESXi targeting, but provides limited public technical detail on the family’s internal functionality, encryption workflow, or broader tradecraft compared with better-documented ransomware families. Based on the available facts, GoGoogle should be understood as an ESXi-targeting ransomware threat within the wave of Linux ransomware development aimed at enterprise virtualization platforms.
1 distinct technique documented for this family, organized by ATT&CK tactic.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.