Content available in original language
class="post-article">
Ransomware C++ Active since 2024

BeastWasHere

VMware ESXi hypervisor ortamlarini hedef alan Linux ELF ransomware. ChaCha20 sifresiyle .vmdk, .vmem, .vmsd, .vmsn, .vmss, .vmxf dosyalarini sifreler. vim-cmd vmsvc/getallvms ile VM listesi alir, kapatir ve sifreler. BEASTWASHERE dosya imzasi. Daemon modu, kismi sifreleme, dis ransom notu destegi.

Threat Profile
Type Ransomware
Programming LanguageC++
C2 Protocolcustom
First Seen2024
Targets VMware ESXi Hypervisorlar
Purpose / Capabilities
  • ESXi VM Encryption
No C2 servers have been identified for this family yet.

Research Reports (1)

Kritik

BeastWasHere ESXi Ransomware 66f86812 -- ELF-32bit-Linux ChaCha20-encryption vim-cmd-vmsvc-getallvms VMDK-VMEM-VMXF BEASTWASHERE-marker beast-log default-key daemon-mode partial-encryption | Kritik

BeastWasHere ESXi Ransomware 66f86812 ELF32 89KB. vim-cmd vmsvc/getallvms ile ESXi VM otomasyonu. .vmdk/.vmem/.vmsd/.vmsn/.vmss/.vmxf sifreleme. BEASTWASHERE imzasi. ChaCha20. beast.log. Daemon modu.

Read Report →