A new ransomware operation uncovered by MalwareHunterTeam, has the ability to encrypt both Windows and Linux VMWare ESXi servers in attacks on corporate networks.
The ransomware is simply identified as RedAlert or N13V. According to researchers, the Linux encryptor used by the attacker is created to attack VMware ESXi servers with command-line options that allow the attackers to shut down all running virtual machines before they encrypt files.
When encrypting files, the ransomware utilizes the NTRUEncrypt public-key encryption algorithm. This algorithm supports different “Parameter Sets,” which offers different levels of security.
When encrypting files, the ransomware will only target files that are linked to virtual machines of VMware ESXi, including log files, swap files, virtual disks and memory files.
RedAlert’s Tor payment page displays the ransom note and offers a way to negotiate with the threat actors. While only one Linux encryption system was found on the page, the researchers explained that the page also contains hidden elements that show that there are also Windows decryption systems.
However, RedAlert/N13V only accepts the Monero cryptocurrency for payment. However, the Monero coin is not sold in the United States since it is a privacy coin.
The sources for this piece include an article in BleepingComputer.