news
Windows Ransomware Framed as "Linux" Issue
-
LockBit 5.0 Ransomware Surfaces With Support for Windows, Linux, and ESXi [iophk: There's certainly a lot of FUD out there trying to pretend that various forms of malware are active on Linux. There are some trojans to be sure but nothing on the scale of what afflcts legacy operating systems like Vista11; DLL == Windows TCO]
Despite a crippling global crackdown earlier this year, the LockBit ransomware group has returned with a new cross-platform variant, LockBit 5.0, exhibiting more advanced evasion and encryption capabilities than previous versions.
-
Trend Micro ☛ New LockBit 5.0 Targets Windows, Linux, ESXi [Ed: But how does the attacker get onto the system to begin with?]
The LockBit 5.0 Windows variant uses heavy obfuscation and packing by loading its payload through DLL reflection while implementing anti-analysis technique. The Linux variant has similar functionality with command-line options for targeting specific directories and file types. The ESXi variant specifically targets VMware virtualization infrastructure, designed to encrypt virtual machines.
[....]
The command-line interface mirrors the Windows version's formatting and functionality, providing attackers with the same operational flexibility across both platforms.
-
The Register UK ☛ LockBit's new variant is 'most dangerous yet,' hitting Windows, Linux and VMware ESXi [Ed: A Windows issue (back doors) ported over to Linux, which lacks back doors]
The Windows variant now loads payloads via DLL reflection and employs aggressive anti-analysis packing; the Linux variant accepts command-line directives to tailor which directories and file types to hit; and the ESXi version is built to seize virtualization infrastructure by encrypting VMs. What's more, each encrypted file is stamped with a random 16-character extension, a move designed to make restoring your data even more of a nightmare.