Ankura CTIX FLASH Update - April 5, 2024

Malware Activity

SEXi Ransomware Targets VMWare ESXi Servers

IxMetro Powerhost – a Chilean data center and hosting provider has confirmed they have been attacked by a novel ransomware group self-named "SEXi". The SEXi ransomware group appears to specifically target VMware's ESXi servers, encrypting servers and backups, and renaming encrypted files with a ".SEXi" extension. SEXi's ransom note has been found to be a ".txt" file which simply instructs victims to download and reach out to the attackers via the Session messaging application. In the case of the attack against IxMetro, the ransomware group demanded roughly $140 million in bitcoin for the decryption key. It is currently unknown whether SEXi plans to run a double-extortion operation or whether they will continue to only demand a ransom payment for decryption keys. Additionally, given the novelty of the ransomware, the initial access vector for the attack on the ESXi servers is currently unknown to