Share on LinkedInShare on LinkedIn

ARTICLE · 11 JUNE 2024

Ankura CTIX FLASH Update - June 7, 2024

Researchers at Trend Micro have observed a new Linux variant of TargetCompany ransomware built to infect VMware ESXi environments. TargetCompany is a ransomware operation...

United StatesTechnology

Ransomware/Malware Activity

New version of TargetCompany Ransomware Targets Linux OS in VMware ESXi Environments

Researchers at Trend Micro have observed a new Linux variant of TargetCompany ransomware built to infect VMware ESXi environments. TargetCompany is a ransomware operation that mostly targets organizations in Taiwan, South Korea, India, and Thailand. TargetCompany (aka Mallox) has been known for attacking databases (MySQL, Oracle, SQL Server) since June 2021. The new Linux variant of the ransomware performs a check to determine whether it is running in a VMWare ESXi environment as well as checking whether it is being run with administrator privileges. The ransomware uses a custom shell script for payload execution and delivery, which is coded to exfiltrate data to two different servers for redundancy. TargetCompany encrypts files that have extensions related to virtual machines and appends them with the extension ".locked". The ransom note is a text

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from