Loading story…
Researchers identified a Linux-targeting variant of RansomEXX, marking an expansion of the ransomware family beyond its previously known Windows builds. The malware is a 64-bit ELF executable that encrypts files with AES-256 in ECB mode and appends an RSA-4096-encrypted AES key to each file, using cryptographic functions from the mbedtls library. Analysis found the Linux sample shares code structure, encryption logic, and ransom note language with earlier Windows PE versions, indicating it is a Linux build of the same ransomware family.
The sample appears to have been used in highly targeted intrusions rather than broad campaigns. Researchers found hardcoded victim-specific identifiers embedded in the binary, including the encrypted file extension and extortion contact details, and noted a likely connection to a ransomware attack on a Brazilian government institution because of a nearly identical ransom note. Unlike many mature ransomware strains, the Linux variant lacked common supporting capabilities such as command-and-control communication, process killing, and anti-analysis features, suggesting operators relied on manual targeting and deployment.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
IBM Security X-Force reported a new Linux variant of RansomEXX, dubbed RansomExx2, that was rewritten in Rust while retaining similar encryption behavior to earlier versions. The report also attributed RansomEXX operations to the DefrayX group, also tracked as Hive0091.
Profero found that the Linux RansomEXX encryptor did not lock files during encryption, which could corrupt files and cause the attacker-provided decryptor to fail for at least one paying victim. The firm reverse-engineered the malware and released an open-source decryptor to recover files affected by this issue, provided victims have the decryption key.
An update dated 27 October 2020 said RansomEXX affected the Pernambuco state court system in Brazil (TJPE). The incident reportedly used the .tjpe911 extension and the ransom note !NEWS_FOR_TJPE!.
Researchers discovered a new Linux-targeting file-encrypting Trojan and assessed it to be a Linux build of the RansomEXX ransomware family. Their analysis found strong similarities with previously known Windows RansomEXX samples in code structure, encryption routines, and ransom note wording.
The report assessed with high probability that a recent ransomware attack against a Brazilian government institution involved another RansomEXX variant, based on a ransom note nearly identical to the analyzed Linux sample.
Researchers said the Windows PE sample with hash fcd21c6fca3b9378961aa1865bee7ecb was used in the Texas Department of Transportation ransomware attack, identifying it as a RansomEXX incident.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
id-ransomware.blogspot.com
Open sourcesecurityintelligence.com
Open sourcesentinelone.com
Open sourcebleepingcomputer.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acronis Threat Research Unit reported active campaigns using **LockBit 5.0**, a major update to the **LockBit** ransomware-as-a-service (RaaS) operation that broadens targeting across **Windows, Linux, and VMware ESXi** in coordinated intrusions. The variant continues **double extortion** (data theft plus encryption) and is positioned for enterprise impact by enabling attackers to hit endpoints, servers, and hypervisors—where a single ESXi compromise can disrupt many virtual machines at once. Reporting also notes the group’s claimed ability to operate against **Proxmox** virtualization environments, further expanding the potential attack surface in organizations adopting alternative hypervisors. Technical analysis highlights stronger and more enterprise-focused builds, with the **Windows** payload using advanced defense-evasion and anti-analysis techniques such as packing/obfuscation, **DLL unhooking**, **process hollowing**, and **ETW (Event Tracing for Windows) patching**, alongside log-clearing to reduce forensic visibility. The **Linux/ESXi** builds are described as less reliant on packing but use extensive string encryption to hinder detection, while maintaining strong encryption routines and using randomized file extensions; Acronis-linked reporting also cites faster encryption and continuity with LockBit 4’s design. Victimology cited in coverage indicates a heavy focus on the **U.S. business sector** and a broad spread across industries (including manufacturing, healthcare, education, financial services, and government), with dozens of recent leak-site postings used to pressure victims and demonstrate ongoing operational tempo despite law-enforcement disruption efforts.
Jun 29, 2026
SentinelLABS reported the first observed Linux ELF variant of **Cl0p** ransomware, linking it to an attack that likely hit a university in Colombia in late 2022. The malware mirrors parts of Cl0p’s Windows logic but appears less mature, lacking features such as exclusion logic, command-line options, and RSA-based protection for encryption keys. Researchers said the victim’s data was later posted to Cl0p’s onion leak site, showing the intrusion combined file encryption with data extortion. The Linux strain contains a critical cryptographic flaw that allows recovery of encrypted files without paying the ransom. SentinelLABS found the malware uses a hardcoded `RC4` master key to wrap per-file `RC4` keys, and also leaks stack and file metadata into generated key files. Based on those weaknesses, the researchers released a free decryptor and warned that ransomware targeting Linux systems continues to grow across server and cloud environments.
Jun 29, 2026
BlackSuit ransomware has emerged as a cross-platform threat targeting **Windows**, **Linux**, and **VMware ESXi** environments, with researchers documenting separate Windows and Linux samples and noting code similarities to **Royal ransomware**. The malware encrypts files with **AES**, drops ransom notes with payment instructions and a **Tor** contact link, and appears designed to support enterprise-impacting attacks across mixed operating environments. On Windows, BlackSuit supports victim identification, mutex-based single-instance execution, network share enumeration, shadow copy deletion, safe boot modification, self-deletion, and host profiling consistent with **MITRE ATT&CK `T1082` (System Information Discovery)**. On Linux, the ELF variant can terminate VMware-related services such as `vmsyslog`, shut down active virtual machines, and optionally focus encryption on VMware-associated files, indicating a deliberate effort to maximize disruption in virtualized infrastructure before encrypting data.
Aug 15, 2026