Cicada Ransomware Targets VMware ESXi Servers

A new Linux variant of the Cicada ransomware, attributed to the advanced persistent threat (APT) group known as APT10, is now targeting VMware ESXi servers. APT10, believed to be state-sponsored and associated with China, has a long history of cyber espionage activities. However, this shift towards ransomware represents a significant evolution in their tactics, focusing on disrupting critical virtualized environments commonly used in enterprises.

The ransomware is engineered to infiltrate VMware ESXi servers, encrypting virtual machine files and rendering them inaccessible. This type of attack is particularly disruptive, as it can affect multiple virtual machines simultaneously, causing widespread operational disruptions. The ransomware employs sophisticated techniques to avoid detection, making it a formidable threat to organizations that rely heavily on virtualized infrastructure.

Given the increasing prevalence of attacks on VMware ESXi servers, security experts are advising organizations to remain vigilant. This includes ensuring that all systems are up to date with the latest security patches and maintaining strong backup and disaster recovery protocols. By implementing these measures, organizations can better protect themselves against the growing threat posed by ransomware like Cicada.

This development underscores the importance of robust cybersecurity practices, especially for critical infrastructure components like VMware ESXi servers, which are integral to modern enterprise operations.

Source: BleepingComputer

The European Cyber Intelligence Foundation is a nonprofit think tank specializing in intelligence and cybersecurity, offering consultancy services to government entities. To mitigate potential threats, it is important to implement additional cybersecurity measures with the help of a trusted partner like INFRA www.infrascan.net, or you can try yourself using check.website.