Loading story…
Attackers used a custom Python ransomware script to encrypt virtual disks on a VMware ESXi hypervisor, taking the victim organization’s virtual machines offline after gaining access through a TeamViewer account that lacked multi-factor authentication on a system used by a Domain Administrator. Sophos said the intrusion moved from initial access to ransomware deployment in just over three hours, with the attackers scanning the network using Advanced IP Scanner and reaching the ESXi server through Bitvise after finding ESXi Shell enabled.
The script, fcker.py, was copied to the hypervisor and executed against multiple datastores, where it shut down VMs, encrypted datastore files with OpenSSL using per-file AES material, overwrote the originals, and tried to remove evidence. Sophos identified the malware as Troj/Ransom-GJR and reported that it generated unique key pairs for each datastore run, leaving encrypted private keys on disk because it had no built-in exfiltration capability; the company urged organizations to harden ESXi, disable ESXi Shell when not required, and enforce MFA on privileged remote-access accounts.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Sophos Rapid Response recovered a copy of the Python ransomware despite the attackers' attempts to overwrite and delete it. The analysis found the malware used OpenSSL-based per-file encryption, generated unique key pairs per datastore execution, and left encrypted private keys on disk because it lacked exfiltration capability.
Roughly three hours after the network scan, the attackers copied a Python script named fcker.py to the ESXi datastore and executed it once per targeted datastore. The script shut down virtual machines and encrypted files on three datastores, taking the victim's VMs offline.
Just before 2 a.m., the attackers downloaded the Bitvise SSH client and used it to access the VMware ESXi server. They were able to do so because ESXi Shell had been enabled previously and not disabled afterward.
About ten minutes after gaining access, the attackers downloaded and ran Advanced IP Scanner to identify targets on the victim network. The scan helped them locate the VMware ESXi server later used in the attack.
Sophos said the ransomware intrusion began when attackers logged into a TeamViewer account without multi-factor authentication on a computer used by a Domain Administrator. This initial access started the attack sequence that later reached the ESXi hypervisor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that the **Memento Team** compromised a victim network through an exposed, unpatched **VMware vCenter Server** and remained inside the environment for more than six months. The attackers conducted hands-on-keyboard operations over **RDP**, used tools including **Impacket**, **Mimikatz**, **Plink**, **Process Hacker**, **BCWipe**, and a Python keylogger, and also exfiltrated data while threatening to leak it publicly as part of a **$1 million** extortion demand. After an initial attempt to encrypt files was partly blocked by endpoint protection, the group changed tactics and used **password-protected WinRAR archives** to bypass encryption defenses: they copied victim files into encrypted archives, encrypted the archive passwords, and deleted the originals. Sophos said the same exposed vCenter server was also exploited by other intruders to deploy **XMR** and **XMRig** cryptocurrency miners during the intrusion window, while the victim ultimately restored most systems from backups and investigators recovered some files because security logs had captured the archive passwords.
Aug 14, 2026
A major global equipment manufacturer suffered a severe ransomware attack orchestrated by the BlackSuit ransomware group, also known as Ignoble Scorpius. The attack began with a vishing (voice phishing) campaign in which an attacker impersonated the company's IT help desk and convinced an employee to enter their VPN credentials into a phishing site. Using these stolen credentials, the attackers gained initial access to the corporate network. Once inside, they escalated privileges by executing a DCSync attack on a domain controller, allowing them to steal highly privileged credentials, including those of a key service account. The attackers then moved laterally across the network using Remote Desktop Protocol (RDP), Server Message Block (SMB), and tools such as Advanced IP Scanner and SMBExec to map the environment and identify valuable assets. Persistence was established by deploying AnyDesk and a custom remote access trojan (RAT) as scheduled tasks on domain controllers. The threat actors compromised a second domain controller and extracted the NTDS.dit database, which contains all user password hashes, enabling further credential compromise. Over 400 GB of sensitive data was exfiltrated using a renamed rclone utility. To erase forensic evidence and hinder incident response, the attackers deployed CCleaner before launching the ransomware payload. The BlackSuit ransomware was deployed using Ansible, resulting in the simultaneous encryption of hundreds of virtual machines across nearly 60 VMware ESXi hosts, causing widespread operational disruption. The attackers demanded a $20 million ransom, which the organization refused to pay. In response, the manufacturer implemented several security measures, including upgrading to newer Cisco Adaptive Security Appliance firewalls, enforcing multi-factor authentication, segmenting the network, deactivating NTLM, and restricting administrative access to isolated VLANs. The incident highlights the significant risks posed by social engineering and credential theft, as well as the sophisticated tactics used by modern ransomware groups. The attack demonstrates the importance of robust incident response, credential hygiene, and layered security controls to mitigate the impact of such breaches. The use of legitimate remote access tools and living-off-the-land techniques by the attackers complicated detection and response efforts. The exfiltration of large volumes of sensitive data prior to encryption underscores the dual extortion tactics now common among ransomware operators. The manufacturer’s refusal to pay the ransom and rapid implementation of enhanced security controls serve as a case study in post-incident resilience. The attack also illustrates the growing trend of targeting virtualization infrastructure, such as VMware ESXi hosts, to maximize operational disruption. Security researchers and incident responders continue to analyze the tactics, techniques, and procedures (TTPs) used in this attack to inform defensive strategies for other organizations.
Jun 29, 2026
Trend Micro reported that the Linux-based **Cheerscrypt** ransomware has been used in attacks against VMware **ESXi** servers, underscoring continued criminal focus on hypervisors that can disrupt many virtual machines at once. Researchers said the malware appears to be derived from the leaked **Babuk** source code—especially its ESXi-oriented Linux variant—but was modified for the operator’s own campaign and paired with a **double-extortion** approach. The malware requires a target path as input, forcibly stops virtual machine processes with `esxcli` so VMware-related files can be encrypted, appends the `.Cheers` extension to locked files, and drops a ransom note titled **"How to Restore Your Files.txt"**. Trend Micro said Cheerscrypt uses the **SOSEMANUK** stream cipher and generates per-file keys through **ECDH** with an embedded public key and randomness from `/dev/urandom`, highlighting a technically adapted ransomware strain built specifically to maximize impact on virtualized infrastructure.
Aug 14, 2026