Ransomware Rampage: Play Targets VMWare ESXi with a Linux Twist

Trend Micro’s latest find: Play ransomware targets VMWare ESXi environments. This Linux variant hints at a broader criminal strategy, expanding their victim pool and ransom success.

Hot Take:

Linux users, it’s time to lock your doors and windows because Play ransomware just found a new playground! It seems that cybercriminals are now eyeing your VMWare ESXi environments with the same glint they once reserved for Windows. If you thought you were safe, think again!

Key Points:

  • Trend Micro found a Linux variant of Play ransomware targeting VMWare ESXi environments.
  • This is the first time Play has been seen targeting ESXi environments.
  • Play ransomware is known for double-extortion tactics and evasion techniques.
  • The URL used for hosting the encryptor is linked to the Prolific Puma threat actor.
  • Revolver Rabbit, another threat actor, has registered over 500,000 malicious domains using RDGAs.

Membership Required

 You must be a member to access this content.

View Membership Levels
Already a member? Log in here