Ransomware New ransomware: a cross-platform future The new Luna and Black Basta ransomware strains are capable of attacking Windows, Linux and VMware ESXi. Julia Glazova July 20, 2022 Ransomware groups are of late increasingly targeting not only Windows computers, but Linux devices and ESXi virtual machines. We’ve already spotlighted the BlackCat gang, which distributes malware written in the cross-platform language Rust and is capable of encrypting such systems. Our experts analyzed two more malware families that recently appeared on the dark web with similar functionality: Black Basta and Luna. Black Basta — ransomware for ESXi Black Basta was first discovered in February. It exists in two versions: for Windows and for Linux, with the latter primarily targeting ESXi virtual machine images. A standout feature of the Windows version is that it boots the system in safe mode before encrypting. This allows the malware to evade detection by security solutions, many of which don’t work in safe mode. At the time of posting, Black Basta operators had released information on 40 victims, among them manufacturing and electronics firms, contractors, and others. According to Kaspersky, their targets are located in the U.S., Australia, Europe, Asia, and Latin America. Luna — more Rust-based ransomware Our researchers discovered the Luna malware in June. Also written in Rust, it’s capable of encrypting both Windows and Linux devices, as well as ESXi virtual machine images. In an ad on the dark web, the cybercriminals claim to cooperate only with Russian-speaking partners. This means that the targets of interest to the attackers most likely are outside the former Soviet Union. This is also evidenced by the fact that the ransom note embedded into the code of the ransomware is written in English, albeit with mistakes. How to protect yourself from ransomware Ransomware remains a serious threat to business. New players continue to appear on the market and quickly pick up on the most disruptive trends. To stay safe, you need to always be tuned in to the threat landscape and build your protection strategy based on it. And remember that all internet-facing corporate devices must be equipped with security solutions, including servers running Linux — attacks on them have become more frequent recently.
Read next Just breathe! Unusual biometrics based on odor We review a recent study on biometric authentication that uses breath analysis.
Tips Five reasons to switch to ZTNA and zero trust: why companies have outgrown VPN How VPN attacks, growing infrastructure complexity, and regulatory requirements are all accelerating businesses’ shift to Zero Trust Network Access.
Tips Reading between the lines: how to read e-books safely We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers
Tips The eMudhra certificate incident: how organizations can respond How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.