Sunday , April 20 2025

Akira ransomware targets VMware ESXi servers

The Akira ransomware operation uses a Linux encryptor to encrypt VMware ESXi virtual machines in double-extortion attacks against companies worldwide.

Akira first emerged in March 2023, targeting Windows systems in various industries, including education, finance, real estate, manufacturing, and consulting.

Samsung phone is saving your passwords in plain text

You copy a password from your manager, thinking it's safe. Meanwhile, your phone is saving it in plain text. Samsung...
Read More
Samsung phone is saving your passwords in plain text

UK Software Firm Exposed 8 million of Healthcare Worker Records

A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured...
Read More
UK Software Firm Exposed 8 million of Healthcare Worker Records

GitHub Enterprise Server Vulns Expose Risk of Code Execution

GitHub has released security updates for GitHub Enterprise Server to fix several vulnerabilities, including a high-severity flaw that could allow...
Read More
GitHub Enterprise Server Vulns Expose Risk of Code Execution

CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers

Hackers can exploit a vulnerability in Asus routers to execute unauthorized functions. This serious issue, rated 9.2 out of 10,...
Read More
CVE-2025-2492  ASUS warns of critical auth bypass flaw in routers

16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia

According to Shadowserver Foundation around 17,000 Fortinet devices worldwide have been compromised using a new technique called "symlink". This number...
Read More
16,000+  Fortinet devices compromised with symlink backdoor, Mostly in Asia

Patch now! Critical Erlang/OTP SSH Vuln Allows UCE

A critical security flaw has been found in the Erlang/Open Telecom Platform (OTP) SSH implementation, allowing an attacker to run...
Read More
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE

CISA warns of increasing risk tied to Oracle legacy Cloud leak

On Wednesday, CISA alerted about increased breach risks due to the earlier compromise of legacy Oracle Cloud servers, emphasizing the...
Read More
CISA warns of increasing risk tied to Oracle legacy Cloud leak

CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App

Cisco issued a security advisory about a serious vulnerability in its Webex App that allows unauthenticated remote code execution (RCE)...
Read More
CVE-2025-20236  Cisco Patches Unauthenticated RCE Flaw in Webex App

Apple released emergency security updates for 2 zero-day vulns

On Wednesday, Apple released urgent operating system updates to address two security vulnerabilities that had already been exploited in highly...
Read More
Apple released emergency security updates for 2 zero-day vulns

Oracle Released Patched for 378 flaws for April 2025

On April 15, 2025, Oracle released a Critical Patch Update for 378 flaws for its products. The patch update covers...
Read More
Oracle Released Patched for 378 flaws for April 2025
Like other enterprise-targeting ransomware gangs, the threat actors steal data from breached networks and encrypt files to conduct double extortion on victims, demanding payments that reach several million dollars.

Since launching, the ransomware operation has claimed over 30 victims in the United States alone, with two distinct activity spikes in ID Ransomware submissions at the end of May and the present.

Akira activity in the past months
Akira activity in the past months
Source: BleepingComputer

Akira targets VMware ESXi

The Linux version of Akira was first discovered by malware analyst rivitna, who shared a sample of the new encryptor on VirusTotal last week.

BleepingComputer’s analysis of the Linux encryptor shows it has a project name of ‘Esxi_Build_Esxi6,’ indicating the threat actors designed it specifically to target VMware ESXi servers.

For example, one of the project’s source code files is /mnt/d/vcprojects/Esxi_Build_Esxi6/argh.h.

Over the past few years, ransomware gangs have increasingly created custom Linux encryptors to encrypt VMware ESXi servers as the enterprise moved to use virtual machines for servers for improved device management and efficient use of resources.

By targeting ESXi servers, a threat actor can encrypt many servers running as virtual machines in a single run of the ransomware encryptor.

However, unlike other VMware ESXi encryptors analyzed by BleepingComputer, Akira’s encryptors do not contain many advanced features, such as the automatic shutting down of virtual machines before encrypting files using the esxcli command.

With that said, the binary does support a few command line arguments that allow an attacker to customize their attacks:

  • -p –encryption_path (targeted file/folder paths)
  • -s –share_file (targeted network drive path)
  • – n –encryption_percent (percentage of encryption)
  • –fork (create a child process for encryption)

The -n parameter is particularly notable as it allows attackers to define how much data is encrypted on each file.

The lower that setting, the speedier the encryption, but the more likely that victims will be able to recover their original files without paying a ransom.
Files encrypted by Akira on a Linux server, Source: BleepingComputer

When encrypting files, the Linux Akira encryptor will target the following extensions:

Strangely, the Linux locker appears to skip the following folders and files, all related to Windows folders and executables, indicating that the Linux variant of Akira was ported from the Windows version.

Cyble’s analysts, who also published a report about the Linux version of Akira today, explain that the encryptor includes a public RSA encryption key and leverages multiple symmetric key algorithms for the file encryption, including AES, CAMELLIA, IDEA-CB, and DES.

The symmetric key is used to encrypt the victims’ files and is then encrypted with the RSA public key. This prevents access to the decryption key unless you have the RSA private decryption key only held by the attackers.

Encrypted files with be renamed to have the .akira extension, and a hardcoded ransom note named akira_readme.txt will be created in each folder on the encrypted device.

Akira ransom note dropped on Linux servers Source: BleepingComputer

The expansion of Akira’s targeting scope is reflected in the number of victims announced by the group recently, which only makes the threat more severe for organizations worldwide.

Unfortunately, adding Linux support is a growing trend among ransomware groups, with many using readily-available tools to do it, as this is an easy and almost foolproof way to increase profits.

Other ransomware operations that utilize Linux ransomware encryptors, with most targeting VMware ESXi, include RoyalBlack BastaLockBitBlackMatterAvosLockerREvilHelloKittyRansomEXX, and Hive.

Source: Bleepingcomputer

 

Check Also

PwC

PwC exits more than a dozen countries in push to avoid scandals: FT reports

PwC has ceased operations in more than a dozen countries that its global bosses have …

Leave a Reply

Your email address will not be published. Required fields are marked *