Mallox Ransomware Variant Targets Privileged VMWare ESXi Environments

Mallox (TargetCompany) has deployed a new Linux ransomware variant targeting VMware ESXi hosts that only executes when run with administrative privileges and if the system name indicates an ESXi hypervisor ("vmkernel"). The variant uses a custom shell script to download and run the payload, drops TargetInfo.txt (exfiltrated to two separate servers), encrypts files appending ".locked" and drops a ransom note (HOW TO DECRYPT.txt), and deletes the payload after execution to hinder response; Trend Micro attributes the activity to a Mallox affiliate and recommends MFA, robust backups (3-2-1), and regular patching.