{"id":44967,"date":"2022-01-24T00:00:00","date_gmt":"2022-01-24T00:00:00","guid":{"rendered":"urn:uuid:91e3506e-42b6-7043-ccf4-c3cb86529fba"},"modified":"2022-01-24T00:00:00","modified_gmt":"2022-01-24T00:00:00","slug":"analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/","title":{"rendered":"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/a\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/analysis_and%20mpact_of_lockbit_ransomwares_first_linux_and_vmware_esxi_variant.jpg\"><!-- OneTrust Cookies Consent Notice start for trendmicro.com --><!-- OneTrust Cookies Consent Notice end for trendmicro.com --> <!-- Begin mPulse library --> <!-- END mPulse library --> <head> <meta charset=\"UTF-8\"> <meta name=\"viewport\" content=\"width=device-width\"> <meta name=\"description\"> <meta name=\"robots\" content=\"index,follow\"> <meta name=\"keywords\" content=\"articles, news, reports,ransomware,research\"> <meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge,chrome=1\"> <meta name=\"template\" content=\"article1withouthero\"> <meta property=\"article:published_time\" content=\"2022-01-24\"> <meta property=\"article:tag\" content=\"ransomware\"> <meta property=\"article:section\" content=\"research\"> <link rel=\"icon\" type=\"image\/ico\" href=\"\/content\/dam\/trendmicro\/favicon.ico\"> <link rel=\"canonical\" href=\"https:\/\/www.trendmicro.com\/en_us\/research\/22\/a\/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html\"> <title>Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant<\/title> <link href=\"https:\/\/fonts.googleapis.com\/css?family=Open+Sans:300,300i,400,400i,600\" rel=\"stylesheet\">\n<link href=\"\/\/customer.cludo.com\/css\/296\/1798\/cludo-search.min.css\" type=\"text\/css\" rel=\"stylesheet\"> <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/trendresearch\/clientlibs\/clientlib-trendresearch.min.css\" type=\"text\/css\"> <meta property=\"og:url\" content=\"https:\/\/www.trendmicro.com\/en_us\/research\/22\/a\/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html\"><br \/>\n<meta property=\"og:title\" content=\"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant\"><br \/>\n<meta property=\"og:site_name\" content=\"Trend Micro\"><br \/>\n<meta property=\"og:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/a\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/analysis_and%20mpact_of_lockbit_ransomwares_first_linux_and_vmware_esxi_variant.jpg\"><br \/>\n<meta property=\"og:locale\" content=\"en_US\"> <meta name=\"twitter:card\" content=\"summary_large_image\"><br \/>\n<meta name=\"twitter:site\" content=\"@TrendMicro\"><br \/>\n<meta name=\"twitter:title\" content=\"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant\"><br \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/a\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/analysis_and%20mpact_of_lockbit_ransomwares_first_linux_and_vmware_esxi_variant.jpg\"> <\/head> <body class=\"articlepage page basicpage context-business\" id=\"readabilityBody\" readability=\"50.234028244788\"> <!-- Page Scroll: Back to Top --> <a id=\"page-scroll\" title=\"VerticalPageScroll\" href=\"javascript:jumpScroll($(this).scrollTop());\"> <span class=\"icon-chevron-up\"><\/span> <\/a> <!-- \/* Data Layer *\/ --> <\/p>\n<div class=\"root responsivegrid\">\n<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12 \">\n<div class=\"articleBodyNoHero aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"research-layout article container\" role=\"contentinfo\">\n<article class=\"research-layout--wrapper row\" data-article-pageid=\"420154311\">\n<div class=\"col-xs-12 col-md-12 one-column\">\n<div class=\"col-xs-12 col-md-12\" readability=\"8.2949061662198\">\n<div class=\"article-details\" role=\"heading\" readability=\"36.107238605898\"> <span class=\"article-details__bar\" role=\"img\"><\/span> <\/p>\n<p class=\"article-details__display-tag\">Ransomware<\/p>\n<p class=\"article-details__description\">LockBit ransomware&#8217;s operators announced the release of its first Linux and ESXi variant in October. With samples also spotted in the wild, we discuss the impact and analysis of this variant.<\/p>\n<p class=\"article-details__author-by\">By: Junestherry Dela Cruz <time class=\"article-details__date\">January 24, 2022<\/time> <span>Read time:&nbsp;<\/span><span class=\"eta\"><\/span> (<span class=\"words\"><\/span> words) <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<hr class=\"research-layout-divider\"> <main class=\"main--content col-xs-12 col-md-8 col-md-push-2\"> <\/p>\n<div class=\"richText\" readability=\"38.519112207152\">\n<div readability=\"22.716399506782\">\n<p>In our monitoring of the LockBit <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/definition\/ransomware\">ransomware<\/a>\u2019s intrusion set, we found an announcement for LockBit Linux-ESXi Locker version 1.0 on October 2021 in the underground forum &#8220;RAMP,&#8221; where potential affiliates can find it. This signifies the LockBit ransomware group\u2019s efforts to expand its targets to Linux hosts. Since October, we have been seeing samples of this variant in the wild.<\/p>\n<p>This variant could have a big impact on victim organizations because of how ESXi, VMware\u2019s hypervisor helps in managing servers.<\/p>\n<p><span class=\"body-subhead-title\">Analysis of the variant<\/span><\/p>\n<p>Lockbit Linux-ESXi Locker version 1.0 uses a combination of Advanced Encryption Standard (AES) and elliptic-curve cryptography (ECC) algorithms for data encryption. From our analysis, we can see that this version of LockBit can accept parameters, as detailed in Figure 1.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/a\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/fig%201Parameters%20accepted%20by%20the%20Linux-ESXi%20version%20of%20LockBit.jpg\" alt=\"Figure 1. Parameters accepted by the Linux-ESXi version of LockBit\"><figcaption>Figure 1. Parameters accepted by the Linux-ESXi version of LockBit<\/figcaption><\/figure>\n<\/p><\/div>\n<div>\n<div class=\"richText\" readability=\"37.185833968012\">\n<div readability=\"19.83244478294\">\n<p>This version of the ransomware has logging capabilities and can log the following information:<\/p>\n<ul>\n<li><span class=\"rte-red-bullet\">Processor information<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Volumes in the system<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Virtual machines (VMs) for skipping<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Total files<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Total VMs<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Encrypted files<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Encrypted VMs<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Total encrypted size<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Time spent for encryption<\/span><\/li>\n<\/ul>\n<p>This variant also contains commands necessary for encrypting VM images&nbsp;hosted on ESXi servers, as listed in Table 1.<\/p>\n<table cellpadding=\"1\" cellspacing=\"0\" border=\"1\" width=\"100%\">\n<tbody readability=\"4\">\n<tr>\n<th scope=\"row\">Command<\/th>\n<td><b>Description<\/b><\/td>\n<\/tr>\n<tr readability=\"2\">\n<th scope=\"row\"><span>vm-support &#8211;listvms&nbsp;<\/span><\/th>\n<td>Obtain a list of all registered and running VMs<\/td>\n<\/tr>\n<tr readability=\"2\">\n<th scope=\"row\"><span>esxcli vm process list&nbsp;<\/span><\/th>\n<td>Get a list of running VMs&nbsp;<\/td>\n<\/tr>\n<tr readability=\"2\">\n<th scope=\"row\"><span>esxcli vm process kill &#8211;type&nbsp;&nbsp; force &#8211;world-id&nbsp;<\/span><\/th>\n<td>Power off the VM from the list&nbsp;<\/td>\n<\/tr>\n<tr readability=\"2\">\n<th scope=\"row\"><span>esxcli storage filesystem list&nbsp;<\/span><\/th>\n<td>Check the status of data storage&nbsp;<\/td>\n<\/tr>\n<tr>\n<th scope=\"row\"><span>\/sbin\/vmdumper %d suspend_v&nbsp;<\/span><\/th>\n<td>Suspend VM&nbsp;<\/td>\n<\/tr>\n<tr>\n<th scope=\"row\"><span>vim-cmd hostsvc\/enable_ssh&nbsp;<\/span><\/th>\n<td>Enable SSH&nbsp;<\/td>\n<\/tr>\n<tr>\n<th scope=\"row\"><span>vim-cmd hostsvc\/autostartmanager\/enable_autostart false&nbsp;<\/span><\/th>\n<td>Disable autostart&nbsp;<\/td>\n<\/tr>\n<tr>\n<th scope=\"row\"><span>vim-cmd hostsvc\/hostsummary grep cpuModel&nbsp;<\/span><\/th>\n<td>Determine ESXi CPU model<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Table 1. Commands for encrypting VM images hosted on ESXi servers<\/p>\n<p>The ransom note is typical of LockBit attacks. It advertises the speed of <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/21\/h\/lockbit-resurfaces-with-version-2-0-ransomware-detections-in-chi.html\">LockBit 2.0<\/a>, lists down the leak sites where the LockBit group threatens to publish stolen information, and ends with a recruitment ad for potential insiders enticing them with \u201cmillions of dollars\u201d in exchange for access to valuable company data.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/a\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/fig%202%20A%20ransom%20note%20of%20the%20Linux-ESXi%20version%20of%20LockBit%20a.jpg\" alt=\"Figure 2 LockBit ransom note\"> <\/figure>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/a\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/fig%202%20A%20ransom%20note%20of%20the%20Linux-ESXi%20version%20of%20LockBit%20b.jpg\" alt=\"Figure 2 LockBit ransom note\"><figcaption>Figure 2. A ransom note of the Linux-ESXi version of LockBit<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"31.5\">\n<div readability=\"8\">\n<p>LockBit&#8217;s operators typically threaten to publish data they stole from their victims on their leak site once their targeted organizations have failed to comply with their ransom demands.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/a\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/LockBit%20leak%20blog.jpg\" alt=\"Figure 3. A screenshot of LockBit 2.0\u2019s leak site\"><figcaption>Figure 3. A screenshot of LockBit 2.0\u2019s leak site<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"37.474698795181\">\n<div readability=\"23.421686746988\">\n<p><span class=\"body-subhead-title\">Impact of the variant<\/span><\/p>\n<p>The release of this variant is in line with how <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/cybercrime-and-digital-threats\/modern-ransomwares-double-extortion-tactics-and-how-to-protect-enterprises-against-them\">modern ransomware<\/a> groups have been shifting their efforts to target and encrypt Linux hosts such as ESXi servers. An ESXi server typically hosts multiple VMs, which in turn hold important data or services for an organization. The successful encryption by ransomware of ESXi servers could therefore have a large impact on targeted companies. This trend was spearheaded by ransomware families like <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/ransomware-spotlight\/ransomware-spotlight-revil\">REvil<\/a> and <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/21\/e\/what-we-know-about-darkside-ransomware-and-the-us-pipeline-attac.html\">DarkSide<\/a>.<\/p>\n<p><span class=\"body-subhead-title\">Recommendations<\/span><\/p>\n<p>ESXi offers organizations an easier way to manage their servers. But ransomware operators are also mirroring the transition of organizations to platforms such as ESXi. This development adds LockBit to the list of ransomware families capable of targeting Linux hosts in general and the ESXi platform in particular.<\/p>\n<p>While Linux versions are typically harder to detect, implementing security best practices can still help organizations minimize the possibility of a successful attack. In the case of LockBit, keeping systems up to date can prevent intrusions. This is because LockBit has been known to use access credentials stolen from vulnerable servers and sold in the cybercriminal underground. VMware also provides recommendations for <a href=\"https:\/\/docs.vmware.com\/en\/VMware-vSphere\/7.0\/com.vmware.vsphere.security.doc\/GUID-E9B71B85-FBA3-447C-8A60-DEE2AE1A405A.html\" target=\"_blank\" rel=\"noopener\">enhancing the security<\/a> of ESXi.<\/p>\n<p>Organizations should also consider the following&nbsp;steps&nbsp;to mitigate ransomware threats:<\/p>\n<ul>\n<li><span class=\"rte-red-bullet\"><span>Deploy cross-layered detection and response solutions.&nbsp;Find solutions that can anticipate and respond to ransomware activities, techniques, and movements before the threat culminates.&nbsp;<a href=\"https:\/\/www.trendmicro.com\/en_us\/business\/products\/detection-response.html\">Trend Micro Vision One\u2122\ufe0f<\/a>, for example, helps detect and block ransomware components to stop attacks before they can affect an enterprise.<\/span><\/span><\/li>\n<li><span class=\"rte-red-bullet\"><span>Create&nbsp;a playbook for&nbsp;attack&nbsp;prevention and recovery.&nbsp;Both an incident response (IR)&nbsp;<a href=\"https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800-61\/rev-2\/final\">playbook<\/a>&nbsp;and&nbsp;IR&nbsp;<a href=\"https:\/\/www.cynet.com\/incident-response\/incident-response-sans-the-6-steps-in-depth\/\">frameworks<\/a>&nbsp;help organizations&nbsp;plan&nbsp;for&nbsp;different&nbsp;attacks.<\/span><\/span><\/li>\n<li><span class=\"rte-red-bullet\"><span>Conduct attack simulations.&nbsp;Expose employees to&nbsp;<a href=\"https:\/\/www.nytimes.com\/2021\/06\/03\/us\/politics\/ransomware-cybersecurity-infrastructure.html\">realistic cyberattack simulations<\/a>&nbsp;that can help&nbsp;decision-makers, security personnel, and IR teams&nbsp;identify and prepare&nbsp;for&nbsp;potential security gaps&nbsp;and attacks.<\/span><\/span><b><\/b><\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<div class=\"richText\" readability=\"31\">\n<div readability=\"17.5\">\n<p><b>Indicators of compromise (IOCs)<\/b><\/p>\n<p>SHA256<\/p>\n<ul>\n<li><span class=\"rte-red-bullet\">f3a1576837ed56bcf79ff486aadf36e78d624853e9409ec1823a6f46fd0143ea<\/span><\/li>\n<li><span class=\"rte-red-bullet\">67df6effa1d1d0690c0a7580598f6d05057c99014fcbfe9c225faae59b9a3224<\/span><\/li>\n<li><span class=\"rte-red-bullet\">ee3e03f4510a1a325a06a17060a89da7ae5f9b805e4fe3a8c78327b9ecae84df<\/span><\/li>\n<\/ul>\n<p>YARA rule<b>:<\/b><\/p>\n<blockquote readability=\"24\">\n<p>rule Linux_Lockbit_Jan2022 {<\/p>\n<p>&nbsp;&nbsp; meta:<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; description = &#8220;Detects a Linux version of Lockbit ransomware&#8221;<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; author = &#8220;TrendMicro Research&#8221;<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; date = &#8220;2022-01-24&#8221;<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; hash1 = &#8220;038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4&#8221;<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp; strings:<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $xor_string_1 = &#8220;LockBit Linux\/ESXi locker V:&#8221; xor(0x01-0xff)<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $xor_string_2 = &#8220;LockBit 2.0 the world&#8217;s fastest ransomware since 2019&#8221; xor(0x01-0xff)<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $xor_string_3 = &#8220;Tox ID LockBitSupp&#8221; xor(0x01-0xff)<\/p>\n<p>&nbsp;&nbsp;&nbsp; condition:<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; uint16(0) == 0x457f and filesize &lt; 300KB and<\/p>\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; filesize &gt; 200KB and any of them<\/p>\n<p>}<\/p>\n<\/blockquote><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<section class=\"tag--list\">\n<p>Tags<\/p>\n<\/section>\n<p> <\/main> <\/article>\n<\/div>\n<\/div><\/div>\n<\/div>\n<p> <!-- \/* Core functionality javascripts, absolute URL to leverage Akamai CDN *\/ --> <!--For Modal-start--> <\/p>\n<p> <span>sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk<\/span> <\/p>\n<p> <!--For Modal-end--> <!-- Go to www.addthis.com\/dashboard to customize your tools --> <\/body> Read More <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/22\/a\/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>LockBit ransomware&#8217;s operators announced the release of its first Linux and ESXi variant in October. With samples also spotted in the wild, we discuss the impact and analysis of this variant. Read More HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":44968,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[61],"tags":[9510,9539,9509],"class_list":["post-44967","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trendmicro","tag-trend-micro-research-articles-news-reports","tag-trend-micro-research-ransomware","tag-trend-micro-research-research"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-01-24T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/a\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/analysis_and%20mpact_of_lockbit_ransomwares_first_linux_and_vmware_esxi_variant.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant\",\"datePublished\":\"2022-01-24T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/\"},\"wordCount\":996,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.jpg\",\"keywords\":[\"Trend Micro Research : Articles, News, Reports\",\"Trend Micro Research : Ransomware\",\"Trend Micro Research : Research\"],\"articleSection\":[\"TrendMicro\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/\",\"name\":\"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.jpg\",\"datePublished\":\"2022-01-24T00:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.jpg\",\"width\":699,\"height\":311},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trend Micro Research : Articles, News, Reports\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/trend-micro-research-articles-news-reports\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/","og_locale":"en_US","og_type":"article","og_title":"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-01-24T00:00:00+00:00","og_image":[{"url":"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/a\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/analysis_and%20mpact_of_lockbit_ransomwares_first_linux_and_vmware_esxi_variant.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant","datePublished":"2022-01-24T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/"},"wordCount":996,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/01\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.jpg","keywords":["Trend Micro Research : Articles, News, Reports","Trend Micro Research : Ransomware","Trend Micro Research : Research"],"articleSection":["TrendMicro"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/","url":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/","name":"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/01\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.jpg","datePublished":"2022-01-24T00:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/01\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/01\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.jpg","width":699,"height":311},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/analysis-and-impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Trend Micro Research : Articles, News, Reports","item":"https:\/\/www.threatshub.org\/blog\/tag\/trend-micro-research-articles-news-reports\/"},{"@type":"ListItem","position":3,"name":"Analysis and Impact of LockBit Ransomware\u2019s First Linux and VMware ESXi Variant"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44967","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=44967"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44967\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/44968"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=44967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=44967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=44967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}