Loading story…
RTM Locker has been identified as a private ransomware-as-a-service operation that uses affiliates under tightly controlled rules while expanding beyond Windows to target VMware ESXi environments with a dedicated Linux encryptor. Researchers said the group appears primarily financially motivated, communicates in both Russian and English, and avoids victims in CIS countries and some sensitive sectors to reduce publicity and law-enforcement attention. In ESXi intrusions, the malware targets virtual machines directly, appends the .RTM extension to encrypted files, and leaves ransom notes titled !!! Warning !!!, with attacks also linked to data theft for double extortion.
Technical analysis of the Windows locker showed the malware repeatedly prompts for elevated privileges through UAC, kills selected processes and services, deletes shadow copies, clears event logs, encrypts files across mounted volumes using multithreaded IOCP-based routines, and then self-deletes. Reporting also tied the operation to a private affiliate model that may include former Conti-linked actors, while an internal dispute connected to the Russia-Ukraine war allegedly led to a server leak, reinforcing indications of Russia-linked membership and a geographically dispersed group.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Trellix described Read The Manual (RTM) Locker as a private ransomware-as-a-service operation using affiliates under strict rules intended to avoid publicity and law-enforcement attention. The report also detailed the Windows locker’s behavior, including repeated UAC elevation prompts, process and service termination, shadow copy deletion, event log clearing, multithreaded encryption, and self-deletion.
Quorum Cyber reported that RTM Locker had moved beyond a previously observed Windows encryptor and was deploying a Linux encryptor crafted to target virtual machines on VMware ESXi servers. The attacks used double extortion, appended the ".RTM" extension to encrypted files, and dropped ransom notes named "!!! Warning !!!".
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026
**AvosLocker**, a ransomware-as-a-service operation first identified targeting Windows systems, expanded to Linux with an ELF-based variant designed to hit **VMware ESXi** servers and disrupt virtualized environments. Reporting on the malware shows it was distributed through spam campaigns and exploitation of Microsoft Exchange **ProxyShell**-related flaws, then paired encryption with data theft and victim extortion through Tor-based leak sites and an affiliate program. The Linux strain, often called **Avoslinux**, accepts command-line parameters for thread count and target directories, checks for ESXi-related paths, and attempts to stop running virtual machines before encrypting files and appending the `.avoslinux` extension. Technical analyses describe the Linux payload as a comparatively simple binary that prioritizes VM-related files such as `.vmdk` and `.vmem`, can invoke `esxcli` to kill active VMs, and may encrypt nearly all files on a host, including system files. Researchers found that the Linux variant uses embedded elliptic-curve cryptography with per-file symmetric keys and encrypted metadata appended to each file, while the Windows branch uses different routines including multithreading, network share enumeration, exclusion logic, and encryption that appends the `.avos2` extension before dropping a ransom note. The combined findings show AvosLocker deliberately adapted its tooling to maximize impact against both traditional Windows networks and ESXi-based virtualization infrastructure.
Aug 15, 2026
Researchers have identified **Vect** as a new ransomware-as-a-service operation advertising a purportedly custom-built C++ locker for **Windows, Linux, and VMware ESXi**. The group began recruiting affiliates on a Russian-language cybercrime forum and promotes features including **ChaCha20-Poly1305** encryption, intermittent encryption for faster impact, Safe Mode execution, SMB and WinRM propagation, GPO-based deployment, and built-in packing or crypter functionality. Vect also operates **TOR-only** infrastructure for affiliate onboarding, victim communications, and leak-site publishing, and appears to follow a **double-extortion** model. The group has publicly claimed two victims in **Brazil** and **South Africa**, although neither the intrusions nor the full malware capabilities have been independently verified. Researchers said Vect shows unusually strong operational maturity for a newly observed crew, citing Monero payments, TOX communications, and a revenue-sharing model that waives entry fees for CIS-based affiliates while charging non-CIS applicants. Reporting suggests the operators may be experienced ransomware actors or a rebrand, and defenders were urged to harden exposed **RDP/VPN** and edge appliances such as Fortinet interfaces, segment management networks, watch for Safe Mode abuse and intermittent encryption, and strengthen anti-ransomware controls.
Jul 2, 2026