Linux version of TargetCompany ransomware focuses on VMware ESXi

Trend Micro reports a Linux variant of the TargetCompany ransomware family (aka Mallox/FARGO/Tohnichi) that targets VMware ESXi hosts: a custom shell script verifies administrative privileges and ESXi via uname, exfiltrates a "TargetInfo.txt" to C2 servers, encrypts VM-related file extensions appending ".locked", drops a ransom note, and removes the payload to hinder forensics; activity is attributed to an affiliate called "vampire" and the report includes IOCs and mitigation guidance.