RTM Locker Ransomware Targets Linux Structure

A brand new ransomware binary concentrating on Linux techniques has been attributed to the ransomware-as-a-service (RaaS) RTM group.

Safety researchers at Uptycs shared the findings in an advisory printed on Wednesday, saying that is the primary time the group had created a Linux binary.

“Its locker ransomware infects Linux, NAS, and ESXi hosts and seems to be impressed by Babuk ransomware’s leaked supply code,” defined the corporate.

Similarities within the code embrace strategies to generate random numbers. Additionally they share the kind of information they encrypt. Lastly, each use superior encryption methods to make it tough to get better the encrypted information with out the attacker’s personal key.

Read more on Babuk here: Yanluowang Ransomware’s Russian Links Laid Bare

“It makes use of a mix of […] uneven encryption and […] symmetric encryption to encrypt information.”

The general public key, appended as an extension to (Home windows) or on the finish of (Linux) the encrypted file, is learn to decrypt information. The shared secret is obtained with the attacker’s personal key, permitting file decryption.

“Use of each uneven and symmetric encryption makes it unattainable to decrypt the encrypted information with out the attacker’s personal key,” reads the advisory.

Describing the brand new malware, Uptycs stated it’s particularly geared towards ESXi hosts, servers or knowledge storage gadgets on which VMware ESXi hypervisors have been put in.

Additional, Uptycs famous some variations between RTM Locker and Babuk ransomware.

“Babuk differs barely from RTM Locker through the use of sosemanuk for uneven encryption, whereas RTM Locker makes use of ChaCha20.”

Regardless of the technical evaluation of the brand new binaries, nevertheless, the safety researchers stated the preliminary entry vector for RTM Locker is unknown on the time of writing.

The Uptycs advisory comprises YARA guidelines that can be utilized by system defenders to scan suspicious processes.

One other ransomware not too long ago evolving to focus on Linux techniques is IceFire, which was recently analyzed by safety consultants at SentinelOne.