Loading story…
Researchers detailed DarkRadiation, a Bash-based Linux ransomware family that targets Red Hat, CentOS, and some Debian-based distributions and spreads through an associated SSH worm. The worm accepts base64-encoded credentials, tests password or key-based SSH access, and, after a successful login, downloads and executes the ransomware on the victim host. The operation also uses the Telegram API alongside a command-and-control server to coordinate activity and report infection status.
Once deployed, DarkRadiation installs prerequisites with YUM on CentOS and RHEL systems, encrypts files with OpenSSL AES-CBC, and appends a radioactive-symbol extension to affected files. Researchers found the malware can also overwrite user passwords, delete users, create an attacker-controlled account named ferrum, disable shells, stop Docker containers, and drop a ransom note, indicating an effort to both extort victims and disrupt Linux server operations. The analyzed scripts appeared to still be under development, while detection rates remained low at the time of reporting.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published an analysis of a Bash-based Linux ransomware family it named DarkRadiation, along with an SSH worm used to spread it across victim networks. The report described targeting of Red Hat-, CentOS-, and some Debian-based systems, plus use of Telegram and command-and-control infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators expanded Linux tooling to hit virtualization and storage infrastructure, with **REvil** and **DarkSide** both deploying ELF-based encryptors aimed at **VMware ESXi** hosts and NAS devices. Researchers linked REvil’s Linux samples to the group’s Windows operation through shared configuration traits, including a common RaaS affiliate ID and similarly encoded ransom notes, while noting that encrypting centralized hypervisors and storage can cause disproportionate disruption across enterprise environments. Analysis of DarkSide’s Linux variant showed malware tailored for ESXi environments, including enumeration of host, storage, and vSAN details, termination of running virtual machines, and encryption of files under paths such as `/vmfs/volumes/`. The malware used **ChaCha20** with **RSA-4096**, appended extensions such as `.darkside`, dropped `darkside_readme.txt`, and sent victim information to hard-coded command-and-control servers via HTTP POST. Separate tooling also emerged to extract and decode embedded configuration data from Linux REvil samples, exposing fields such as public keys, affiliate identifiers, campaign IDs, ransom-note filenames, and encrypted file extensions.
Aug 15, 2026
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
Researchers identified a Linux-targeting variant of **RansomEXX**, marking an expansion of the ransomware family beyond its previously known Windows builds. The malware is a 64-bit ELF executable that encrypts files with **AES-256 in ECB mode** and appends an **RSA-4096**-encrypted AES key to each file, using cryptographic functions from the `mbedtls` library. Analysis found the Linux sample shares code structure, encryption logic, and ransom note language with earlier Windows PE versions, indicating it is a Linux build of the same ransomware family. The sample appears to have been used in highly targeted intrusions rather than broad campaigns. Researchers found hardcoded victim-specific identifiers embedded in the binary, including the encrypted file extension and extortion contact details, and noted a likely connection to a ransomware attack on a Brazilian government institution because of a nearly identical ransom note. Unlike many mature ransomware strains, the Linux variant lacked common supporting capabilities such as command-and-control communication, process killing, and anti-analysis features, suggesting operators relied on manual targeting and deployment.
Aug 15, 2026