Linux version of RansomHub ransomware targets VMware ESXi VMs

RansomHub, a Ransomware-as-a-Service operation active since February 2024 and linked to other ransomware families, is deploying a C++ VMware ESXi encryptor targeting virtualized enterprise environments; it supports ESXi-specific commands (snapshot deletion, VM shutdown), disables logging, partially encrypts VM files using ChaCha20 with Curve25519, and writes ransom notes to login/web interfaces. Recorded Future reports confirm a multi-OS capability (Windows, Linux, ESXi) with 45+ claimed victims in 18 countries, and researchers identified a flaw where placing '-1' in /tmp/app.pid causes the ESXi binary to enter an infinite loop, providing a temporary mitigation opportunity.