Loading story…
LUNA (Elastic tracking REF5264) is a Rust-based ransomware family with Windows and Linux variants. Its Windows payload is notably more mature: when launched without arguments, it enumerates drives, attempts to stop or disable 253 services, and terminates up to 997 processes before encrypting files. Such use of native Windows administration capabilities, including process-termination functionality comparable to taskkill, can expose a noisy pre-encryption detection window.
LUNA encrypts files using per-file X25519 key pairs and AES-CTR, appends a public key and the Luna marker to encrypted content, and renames affected files with the .Luna extension. The Linux variant can encrypt selected files or directories but does not adequately exclude critical operating-system files, including passwd, shadow, and sudoers; encrypting these files can destabilize or render a Linux host unusable.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Kaspersky first identified and reported the Rust-based LUNA ransomware family, which has Windows and Linux variants.
Elastic published a YARA rule to identify LUNA Windows and Linux variants and a behavioral endpoint rule to detect attempts to disable Windows Defender services before encryption.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the **Luna** and **Black Basta** ransomware families rapidly advanced the trend toward cross-platform attacks, with both strains capable of targeting virtualized environments. Luna, written in **Rust**, was observed running on **Windows, Linux, and ESXi** and using an uncommon **`x25519` + AES** encryption scheme, while its operators appeared to limit participation to **Russian-speaking affiliates**. **Black Basta**, a newer **C++** ransomware family, was described as maturing quickly and adding capabilities such as **safe-mode reboot** to improve execution and evade defenses. Kaspersky said the group had already claimed **more than 40 victims** across multiple sectors and regions, and noted that its Linux variant focused primarily on **ESXi** systems, reflecting a broader criminal shift toward encrypting virtualization infrastructure to maximize operational disruption.
Aug 14, 2026
Researchers identified a Linux-targeting variant of **RansomEXX**, marking an expansion of the ransomware family beyond its previously known Windows builds. The malware is a 64-bit ELF executable that encrypts files with **AES-256 in ECB mode** and appends an **RSA-4096**-encrypted AES key to each file, using cryptographic functions from the `mbedtls` library. Analysis found the Linux sample shares code structure, encryption logic, and ransom note language with earlier Windows PE versions, indicating it is a Linux build of the same ransomware family. The sample appears to have been used in highly targeted intrusions rather than broad campaigns. Researchers found hardcoded victim-specific identifiers embedded in the binary, including the encrypted file extension and extortion contact details, and noted a likely connection to a ransomware attack on a Brazilian government institution because of a nearly identical ransom note. Unlike many mature ransomware strains, the Linux variant lacked common supporting capabilities such as command-and-control communication, process killing, and anti-analysis features, suggesting operators relied on manual targeting and deployment.
Aug 15, 2026
Researchers detailed **DarkRadiation**, a Bash-based Linux ransomware family that targets **Red Hat, CentOS, and some Debian-based distributions** and spreads through an associated SSH worm. The worm accepts **base64-encoded credentials**, tests password or key-based SSH access, and, after a successful login, downloads and executes the ransomware on the victim host. The operation also uses the **Telegram API** alongside a command-and-control server to coordinate activity and report infection status. Once deployed, DarkRadiation installs prerequisites with **YUM** on CentOS and RHEL systems, encrypts files with **OpenSSL AES-CBC**, and appends a radioactive-symbol extension to affected files. Researchers found the malware can also **overwrite user passwords, delete users, create an attacker-controlled account named `ferrum`, disable shells, stop Docker containers, and drop a ransom note**, indicating an effort to both extort victims and disrupt Linux server operations. The analyzed scripts appeared to still be under development, while detection rates remained low at the time of reporting.
Aug 14, 2026