Threat actors exploit Babuk code leak to develop ransomware variants targeting VMware ESXi

The leak of the Babuk ransomware code in September 2021 has led to the development of multiple ransomware families capable of targeting VMware ESXi systems. Several cybercrime groups have used the leaked source code to create new variants, indicating a growing trend of Babuk code adoption.

Ransomware strains like Cylance, Rorschach and RTM Locker have emerged based on the Babuk source code: in a recent report, cybersecurity firm SentinelOne has identified overlaps between Babuk and ESXi lockers attributed to Conti and REvil.

Other ransomware families like LOCK4, DATAF, Mario and Play have incorporated features from Babuk into their code. However, there is no similarity found between Babuk and ALPHV, Black Basta, Hive and LockBit’s ESXi lockers: there is also a possibility that threat actors may turn to Babuk’s Go-based NAS locker due to its popularity.

In addition, threat actors associated with Royal ransomware, suspected to be former Conti members, have introduced an ELF variant capable of targeting Linux and ESXi environments, used to attack numerous organizations in sectors such as manufacturing, retail, legal services, education, construction, and healthcare in the U.S., Canada, and Germany.

Indicators of Compromise