New RedAlert Ransomware Targets Windows And Linux VMWare ESXi Servers

Share post:

A new ransomware operation uncovered by MalwareHunterTeam, has the ability to encrypt both Windows and Linux VMWare ESXi servers in attacks on corporate networks.

The ransomware is simply identified as RedAlert or N13V. According to researchers, the Linux encryptor used by the attacker is created to attack VMware ESXi servers with command-line options that allow the attackers to shut down all running virtual machines before they encrypt files.

When encrypting files, the ransomware utilizes the NTRUEncrypt public-key encryption algorithm. This algorithm supports different “Parameter Sets,” which offers different levels of security.

When encrypting files, the ransomware will only target files that are linked to virtual machines of VMware ESXi, including log files, swap files, virtual disks and memory files.

RedAlert’s Tor payment page displays the ransom note and offers a way to negotiate with the threat actors. While only one Linux encryption system was found on the page, the researchers explained that the page also contains hidden elements that show that there are also Windows decryption systems.

However, RedAlert/N13V only accepts the Monero cryptocurrency for payment. However, the Monero coin is not sold in the United States since it is a privacy coin.

The sources for this piece include an article in BleepingComputer.

SUBSCRIBE NOW

Related articles

Cyber Security Today, June 21, 2024 – US to ban Kaspersky for businesses, consumers

U.S. to ban the sale of Kaspersky products to consumers and businesses. Welcome to Cyber Security Today. It's Friday...

Biden administration to ban US sales of Kaspersky software over ties to Russia

The Biden administration is set to announce a ban on the sale of Kaspersky Lab's antivirus software in...

Target’s new AI is aimed at employees

Target is introducing a new generative artificial intelligence tool aimed at enhancing the efficiency of its store employees...

Security bug may allow anyone to spoof Microsoft employee emails

A security researcher claims to have discovered a bug that enables anyone to impersonate Microsoft corporate email accounts,...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways