BlackMatter gang rapidly evolves, the group has developed a Linux version that allows operators to targets VMware’s ESXi VM platform.

The BlackMatter ransomware gang has implemented a Linux encryptor to targets VMware ESXi virtual machine platform. This is the last ransomware in order of time that is able to target VM platforms, some of the other ransomware operations that do the same are REvil, RansomExx/Defray, Mespinoza, HelloKitty, and Babuk.

BlackMatter operators developed the Linux version to expand the list of targets and compromise virtualized environments.

The BlackMatter group launched its operations at at the end of July, the gang claims to be the successor of Darkside and REvil groups. Lile other ransomware operations, BlackMatter also set up its leak sitewhere it will publish data exfiltrated from the victims before encrypting their system.

The birth of the BlackMatter ransomware was first spotted by researchers at Recorded Future who also reported that the gang is setting up a network of affiliates using ads posted on two cybercrime forums, such as Exploit and XSS.

The group is recruiting crooks with access to the networks of large enterprises, which have revenues of $100 million/year or larger, in an attempt to infect them with its ransomware. The group is looking for corporate networks in the US, the UK, Canada, or Australia.

BlackMatter ransomware operators announced that they will not target healthcare organizations, critical infrastructure, organizations in the defense industry, and non-profit companies.

BlackMatter forum post – Source THE RECORDThis week, researchers from MalwareHunterTeam first spotted a Linux ELF64 encryptor for the BlackMatter ransomware gang that was designed to target VMware ESXi servers.

Another Linux ransomware sample that is using esxcli: 6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502File is simply named “Linux.Encryptor”…cc @VK_Intel @demonslay335 pic.twitter.com/0kgP3vCj32— MalwareHunterTeam (@malwrhunterteam) August 4, 2021
So it is BlackMatter: https://t.co/6Kag17u9wKAnd then the similarities to DarkSide (https://t.co/baXgyx8Kfu) not surprising…— MalwareHunterTeam (@malwrhunterteam) August 5, 2021Malware researcher Vitali Kremez analyzed the sample and confirmed it was a BlackMatter variant that targets VMware ESXi servers.

2021-08-05: Introducing #BlackMatter #Ransomware x64 Linux Variant | esxcli variant | usual BlackMatter struct “bot_id” | “bot_company” 1⃣Custom C Methods:///esxi_utilsfiles_procfile_encryptersetup_implweb_reporter///2⃣Encryption Mode | dark/white/min-size https://t.co/kUQvw5FAJv pic.twitter.com/tCiRHeuBsv— Vitali Kremez (@VK_Intel) August 5, 2021Follow me on Twitter: @securityaffairs and Facebook

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini

(SecurityAffairs – hacking, BlackMatter ransomware)

The post BlackMatter ransomware also targets VMware ESXi servers appeared first on Security Affairs.