Loading malware…
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers identified a Linux variant of Aurora ransomware, an ELF binary manually copied to several internal hosts. It includes an -esxi mode that terminates virtual-machine processes before encrypting virtual-machine files.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Le second cluster utilise SQL Server xp_cmdshell exposé; le variant ESXi exécute des commandes esxcli.
Le binaire est copié manuellement dans plusieurs hôtes internes et écrit une bannière SSH dans /etc/ssh/sshd-banner.
Le variant Linux/ESXi chiffre les contenus des fichiers en place avec ChaCha20; il cible notamment les fichiers de machines virtuelles VMware.
Le mode -esxi exécute esxcli vm process list puis esxcli vm process kill --type=force pour libérer les verrous sur les disques virtuels avant chiffrement.
« Windows (sap.exe) : suppression des VSS, désactivation de System Restore ».
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.