Loading story…
ESET reported that the KillDisk malware expanded from Windows to Linux systems, targeting Linux machines with a fake ransomware scheme that demanded $250,000 in exchange for recovery. The malware encrypted filenames and damaged data on infected hosts, displaying a ransom note that claimed victims could regain access after payment.
Researchers found the Linux variant lacked any practical mechanism to restore files, indicating the operation functioned as a destructive wiper rather than true ransomware. The finding reinforced concerns that attackers were using ransomware-style extortion as cover for sabotage, leaving affected organizations with little recovery path beyond backups and system rebuilds.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
ESET published research describing a Linux variant of KillDisk that demanded a $250,000 ransom but lacked any capability to restore encrypted files, indicating the payment demand was not a functional decryption scheme. The report marked a new development in KillDisk activity by documenting Linux targeting.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLABS reported the first observed Linux ELF variant of **Cl0p** ransomware, linking it to an attack that likely hit a university in Colombia in late 2022. The malware mirrors parts of Cl0p’s Windows logic but appears less mature, lacking features such as exclusion logic, command-line options, and RSA-based protection for encryption keys. Researchers said the victim’s data was later posted to Cl0p’s onion leak site, showing the intrusion combined file encryption with data extortion. The Linux strain contains a critical cryptographic flaw that allows recovery of encrypted files without paying the ransom. SentinelLABS found the malware uses a hardcoded `RC4` master key to wrap per-file `RC4` keys, and also leaks stack and file metadata into generated key files. Based on those weaknesses, the researchers released a free decryptor and warned that ransomware targeting Linux systems continues to grow across server and cloud environments.
Jun 29, 2026
Researchers identified a Linux-targeting variant of **RansomEXX**, marking an expansion of the ransomware family beyond its previously known Windows builds. The malware is a 64-bit ELF executable that encrypts files with **AES-256 in ECB mode** and appends an **RSA-4096**-encrypted AES key to each file, using cryptographic functions from the `mbedtls` library. Analysis found the Linux sample shares code structure, encryption logic, and ransom note language with earlier Windows PE versions, indicating it is a Linux build of the same ransomware family. The sample appears to have been used in highly targeted intrusions rather than broad campaigns. Researchers found hardcoded victim-specific identifiers embedded in the binary, including the encrypted file extension and extortion contact details, and noted a likely connection to a ransomware attack on a Brazilian government institution because of a nearly identical ransom note. Unlike many mature ransomware strains, the Linux variant lacked common supporting capabilities such as command-and-control communication, process killing, and anti-analysis features, suggesting operators relied on manual targeting and deployment.
Aug 15, 2026
Security researchers reported that **RuRansom** is a destructive malware strain aimed at systems geolocated in Russia, presenting itself as ransomware while functioning primarily as a wiper. The malware checks a victim’s public IP address through external services and exits unless the host appears to be in Russia, then seeks elevated privileges, scans local, removable, and network drives, deletes `.bak` backup files, and encrypts files with **AES/AES-CBC** while appending the `.fs_invade` extension. It also drops a Russian-language note stating there is no decryption or payment path, underscoring that the operation is intended to damage Russian victims rather than extort them. Researchers said the malware is a **.NET 32-bit PE** sample that can spread in worm-like fashion across connected systems and USB devices, including by copying itself as `Россия-Украина_Война-Обновление.doc.exe`. Trend Micro linked RuRansom to the developer behind **dnWipe** and a downloader for **XMRig**, suggesting an actor experimenting with multiple destructive and financially motivated tools, while noting attribution remains unconfirmed. VMware and Cyble also described multiple variants that attempt privilege escalation and appear to have been developed during the Russia-Ukraine cyber conflict, with encrypted files considered effectively irreversible.
Aug 15, 2026