RTM Locker Expanded Private RaaS Operations to VMware ESXi Attacks

RTM Locker has been identified as a private ransomware-as-a-service operation that uses affiliates under tightly controlled rules while expanding beyond Windows to target VMware ESXi environments with a dedicated Linux encryptor. Researchers said the group appears primarily financially motivated, communicates in both Russian and English, and avoids victims in CIS countries and some sensitive sectors to reduce publicity and law-enforcement attention. In ESXi intrusions, the malware targets virtual machines directly, appends the .RTM extension to encrypted files, and leaves ransom notes titled !!! Warning !!!, with attacks also linked to data theft for double extortion.

Technical analysis of the Windows locker showed the malware repeatedly prompts for elevated privileges through UAC, kills selected processes and services, deletes shadow copies, clears event logs, encrypts files across mounted volumes using multithreaded IOCP-based routines, and then self-deletes. Reporting also tied the operation to a private affiliate model that may include former Conti-linked actors, while an internal dispute connected to the Russia-Ukraine war allegedly led to a server leak, reinforcing indications of Russia-linked membership and a geographically dispersed group.