New Linux version of Royal Ransomware program is aimed at ESXI virtual machines

Altus Intel
Altus Intel
  • Date Time

Cybersecurity researcher Will Thomas from the Equinix threat analysis center (ETAC)

  • -stopvm – stops all working virtual machines so that they can be encrypted;
  • -vmonly – encrypt only virtual machines;
  • -Fork is unknown;

    • -logs is unknown;

  • -id – an identifier of 32 characters.

    • When encrypting files, the Mrowning Program will add an extension “.Royal_u” to all encrypted files on a virtual machine. Previously, antivirus solutions earlier could not detect a new sample Royal Ransomware, but now it is found 23 out of 62 scan models on Viruumotal.

    The difference in the results of scanning the new version of Royal

    Person of extortion groups towards ESXI virtual machines is due to the fact that enterprises switch to virtual machines, since they provide improved devices management and more efficient resource processing. After the deployment of useful loads on the ESXI hosts, operators-carriers use one command to encrypt several servers.

    /Media reports cited above.

    © 2024 - Altus Intel