Article Details
Scrape Timestamp (UTC): 2024-06-05 23:19:21.466
Original Article Text
Click to Toggle View
Linux version of TargetCompany ransomware focuses on VMware ESXi. Researchers observed a new Linux variant of the TargetCompany ransomware family that targets VMware ESXi environments using a custom shell script to deliver and execute payloads. Also known as Mallox, FARGO, and Tohnichi, the TargetCompany ransomware operation emerged in June 2021 and has been focusing on database attacks (MySQL, Oracle, SQL Server) against organizations mostly in Taiwan, South Korea, Thailand, and India. In February 2022, antivirus firm Avast announced the availability of a free decryption tool that covered variants released up to that date. By September, though, the gang bounced back into regular activity targeting vulnerable Microsoft SQL servers and threatened victims with leaking stolen data over Telegram. New Linux variant In a report today, cybersecurity company Trend Micro says that the new Linux variant for TargetCompany ransomware makes sure that it has administrative privileges before continuing the malicious routine. To download and execute the ransomware payload, the threat actor uses a custom script that can also exfiltrate data to two separate servers, likely for redundancy in case of technical issues with the machine or if it gets compromised. Once on the target system, the payload checks if it runs in a VMware ESXi environment by executing the ‘uname’ command and looking for ‘vmkernel.’ Next, a “TargetInfo.txt” file is created and sent to the command and control (C2) server. It contains victim information such as hostname, IP address, OS details, logged-in users and privileges, unique identifiers, and details about the encrypted files and directories. The ransomware will encrypt files that have VM-related extensions (vmdk, vmem, vswp, vmx, vmsn, nvram), appending the “.locked” extension to the resulting files. Finally, a ransom note named “HOW TO DECRYPT.txt” is dropped, containing instructions for the victim on how to pay the ransom and retrieve a valid decryption key. After all tasks have been completed, the shell script deletes the payload using the ‘rm -f x’ command so all traces that can be used in post-incident investigations are wiped from impacted machines. Trend Micro analysts are attributing the attacks deploying the new Linux variant of TargetCompany ransomware to an affiliate named “vampire,” who is likely the same one in a Sekoia report last month. The IP addresses used for delivering the payload and accepting the text file with the victim information were traced to an ISP provider in China. However, this is not enough for accurately determining the origin of the attacker. Typically, TargetCompany ransomware focused on Windows machines but the release of the Linux variant and the shift to encrypting VMWare ESXi machines shows the evolution of the operation. Trend Micro's report includes a set of recommendations such as enabling multifactor authentication (MFA), creating backups, and keeping systems updated. The researchers provide a list of indicators of compromise with hashes for the Linux ransomware version, the custom shell script, and samples related to the affiliate 'vampire.'
Daily Brief Summary
Researchers have identified a new Linux variant of the TargetCompany ransomware, also known as Mallox, FARGO, and Tohnichi, targeting VMware ESXi environments.
This variant employs a custom shell script to gain administrative privileges, deliver, and execute the ransomware payload, and potentially exfiltrate data.
The malware checks for VMware ESXi systems specifically, encrypts files related to VM operations with a ".locked" extension, and drops a ransom note with payment instructions.
The new variant marks an evolution from previous attacks predominantly focused on Windows systems and database environments in Asia.
Cybersecurity firm Trend Micro traced the attacks to an affiliate named "vampire" and linked payload delivery to an ISP provider in China, though the exact origin remains unconfirmed.
After execution, the script deletes the ransomware payload to eliminate forensic evidence, complicating post-incident analysis.
Trend Micro has issued recommendations including enabling multifactor authentication (MFA), regular backups, and system updates, alongside a list of indicators of compromise for detection and prevention.