SEXi Ransomware Rebrands as 'APT Inc.,' Keeps Old Methods

SEXi ransomware operators, now calling themselves “APT Inc.”, have been carrying out active ransomware attacks since February (rebranded in June), using leaked Babuk encryptors to target VMware ESXi and leaked LockBit 3 encryptors for Windows servers; victims report ransom notes and demands ranging from thousands to millions of dollars, and no free recovery/decryptor currently exists.