Loading story…
BlackSuit ransomware has emerged as a cross-platform threat targeting Windows, Linux, and VMware ESXi environments, with researchers documenting separate Windows and Linux samples and noting code similarities to Royal ransomware. The malware encrypts files with AES, drops ransom notes with payment instructions and a Tor contact link, and appears designed to support enterprise-impacting attacks across mixed operating environments.
On Windows, BlackSuit supports victim identification, mutex-based single-instance execution, network share enumeration, shadow copy deletion, safe boot modification, self-deletion, and host profiling consistent with MITRE ATT&CK T1082 (System Information Discovery). On Linux, the ELF variant can terminate VMware-related services such as vmsyslog, shut down active virtual machines, and optionally focus encryption on VMware-associated files, indicating a deliberate effort to maximize disruption in virtualized infrastructure before encrypting data.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Cyble Research and Intelligence Labs published an analysis of the BlackSuit ransomware strain, describing Windows and Linux variants, including Linux functionality aimed at VMware ESXi environments. The report also noted code similarities with Royal ransomware, though no confirmed connection had been established.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026
Kaspersky reported that the **Luna** and **Black Basta** ransomware families rapidly advanced the trend toward cross-platform attacks, with both strains capable of targeting virtualized environments. Luna, written in **Rust**, was observed running on **Windows, Linux, and ESXi** and using an uncommon **`x25519` + AES** encryption scheme, while its operators appeared to limit participation to **Russian-speaking affiliates**. **Black Basta**, a newer **C++** ransomware family, was described as maturing quickly and adding capabilities such as **safe-mode reboot** to improve execution and evade defenses. Kaspersky said the group had already claimed **more than 40 victims** across multiple sectors and regions, and noted that its Linux variant focused primarily on **ESXi** systems, reflecting a broader criminal shift toward encrypting virtualization infrastructure to maximize operational disruption.
Aug 14, 2026
A newly identified ransomware operation known as **RedAlert**, also referenced internally as **N13V**, has been observed targeting corporate networks by encrypting both **Windows** systems and **Linux-based VMware ESXi** servers. The Linux variant is built specifically for ESXi environments and can forcibly shut down running virtual machines before encrypting VM-related files, while encrypted data is renamed with a `.crypt[number]` extension and accompanied by a `HOW_TO_RESTORE` ransom note containing a Tor payment link. Researchers reported that the malware uses the **NTRUEncrypt** public-key algorithm and already shows relatively mature cross-platform capabilities despite appearing to be a newer operation. RedAlert is also conducting **double-extortion** attacks, stealing data before encryption and threatening to publish it on a leak site if victims refuse to pay. Reporting on broader ransomware trends placed RedAlert alongside newer groups such as **0mega** and **Lilith**, underscoring a rise in emerging crews with increasingly capable tooling. In that wider landscape, RedAlert stood out for its focus on enterprise virtualization infrastructure, especially ESXi hosts, adding to concerns that ransomware operators are continuing to prioritize high-impact targets that can disrupt large numbers of systems at once.
Aug 15, 2026