Summary:
There has been a rise in ransomware attacks targeting VMware ESXi hypervisors, which are valuable targets for attackers due to their prevalence in enterprise networks. Organized ransomware groups have been adopting Linux lockers, including Babuk, Conti, and REvil, and using built-in tools for ESXi to kill guest machines and encrypt crucial hypervisor files. The leaked Babuk source code has been used by smaller ransomware operations to create more recognizable ESXi lockers, and there is overlap between the Babuk code and lockers attributed to Conti and REvil. Babuk's longevity was compromised in 2021 when a developer leaked the builder source code for their ransomware tooling.[/subscribe_to_unlock_form]
Summary:
There has been a rise in ransomware attacks targeting VMware ESXi hypervisors, which are valuable targets for attackers due to their prevalence in enterprise networks. Organized ransomware groups have been adopting Linux lockers, including Babuk, Conti, and REvil, and using built-in tools for ESXi to kill guest machines and encrypt crucial hypervisor files. The leaked Babuk source code has been used by smaller ransomware operations to create more recognizable ESXi lockers, and there is overlap between the Babuk code and lockers attributed to Conti and REvil. Babuk's longevity was compromised in 2021 when a developer leaked the builder source code for their ransomware tooling.[emaillocker id="1283"]
The researchers analyzed several ransomware families, including XVGV (aka Babuk 2023), Play Ransomware, Mario Ransomware, Conti POC and ESXi, and RHKRC. The analysis revealed that these ransomware families have similarities in their code, behaviors, and encryption implementation, suggesting that some of them might be related or share a common source. The researchers also compared the different families and identified some unique features of each ransomware, such as the file extension targets, or the ransom note content.
Despite the Babuk source code being leaked, there have been few indications that cybercriminals have adapted it, particularly in the Linux space, which is often overlooked. Researchers identified Babuk-derived ransomware through the code string "Doesn't encrypted files" and found that the Babuk builder specifies a file name for the newly generated binary, e_esxi.out. The ESXi version of Babuk uses the Sosemanuk stream cipher for encryption, while the Windows version uses HC-128, and both use Curve25519-Donna to generate the encryption key.
There is a trend of actors using Babuk builder to develop ESXi and Linux ransomware, especially those with fewer resources who are less likely to modify the source code. Babuk's Go-based NAS locker may also become more popular as it is accessible for developers who are familiar with Go or similar programming languages.
Threat Profile:
References:
The following reports contain further technical details:
https://thehackernews.com/2023/05/babuk-source-code-sparks-9-new.html
[/emaillocker]