New RedAlert ransomware targets Windows And Linux VMWare ESXi servers

A new ransomware operation uncovered by MalwareHunterTeam, has the ability to encrypt both Windows and Linux VMWare ESXi servers in attacks on corporate networks.

The ransomware is simply identified as RedAlert or N13V. According to researchers, the Linux encryptor used by the attacker is created to attack VMware ESXi servers with command-line options that allow the attackers to shut down all running virtual machines before they encrypt files.

When encrypting files, the ransomware utilizes the NTRUEncrypt public-key encryption algorithm. This algorithm supports different “Parameter Sets,” which offers different levels of security.

When encrypting files, the ransomware will only target files that are linked to virtual machines of VMware ESXi, including log files, swap files, virtual disks and memory files.

RedAlert’s Tor payment page displays the ransom note and offers a way to negotiate with the threat actors. While only one Linux encryption system was found on the page, the researchers explained that the page also contains hidden elements that show that there are also Windows decryption systems.

However, RedAlert/N13V only accepts the Monero cryptocurrency for payment. However, the Monero coin is not sold in the United States since it is a privacy coin.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web