Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers

Executive Summary

• SentinelLabs identified 10 ransomware families using VMware ESXi lockers based on the 2021 Babuk source code leaks.


• These variants emerged through H2 2022 and H1 2023, which shows an increasing trend of Babuk source code adoption.


• Leaked source code enables actors to target Linux systems when they may otherwise lack expertise to build a working program.


• Source code leaks further complicate attribution, as more actors will adopt the tools.

Background

Throughout early 2023, SentinelLabs observed an increase in …

actor adoption babuk build code esxi executive hypervisor leaked leaks malware analysis ransomware sentinellabs source code threat threat actor trend vmware vmware esxi