RTM Locker Ransomware Attacks Linux, NAS, and ESXi Servers

The RTM Locker ransomware gang has been discovered to utilize a Linux encryptor that focuses explicitly on virtual machines on VMware ESXi servers, making it the most recent instance of an enterprise-oriented ransomware attack.

Uptycs’ Threat Intelligence unit uncovered the RTM Locker threat faction while conducting dark web reconnaissance.

Since 2015, the RTM cybercrime group has been involved in financial fraud, using a custom-made banking trojan to steal money from their targets.

Trellix cybersecurity firm and Uptycs recently revealed that RTM Locker initiated a new Ransomware-as-a-Service (RaaS) venture, actively hiring affiliates, including ex-Conti cybercriminals.

Technical Analysis

RTM Locker and Babuk ransomware share commonalities, such as ECDH Curve25519 for asymmetric encryption and random number generation. 

However, Babuk uses sosemanuk, while RTM Locker uses ChaCha20 for asymmetric encryption, which differentiates the two.

Upon initial inspection of the ransomware binary, it became apparent that the program was tailored towards ESXi due to two ESXi commands at the beginning of the code.

The binary is statically compiled and stripped, which allows it to run on various systems and makes reverse engineering a challenging task. 

Moreover, the initial access vector remains unknown, adding a layer of complexity to the situation.

Locker Workflow

While in this binary, the most important functions are:-

  • name_threads
  • run_esxi_commands
  • pthread_wrapper_main

Here below, we have mentioned the two ESXi commands that are run using this program:-

  • esxcli vm process list >> vmlist.tmp.txt: This command lists all the ESXi VMs currently running on the system.
  • esxcli vm process kill -t=force -w: This command kills all the ESXi VMs that were found by the previous command.

Due to enhance oversight capabilities and superior resource management, businesses have migrated to virtual machines (VMs) in recent years.

This results in organizations typically utilizing dedicated devices and VMware ESXi servers hosting multiple virtual servers to manage their infrastructure.

Following this trend, ransomware operations have developed Linux encryptors tailored to targeting ESXi servers, which can comprehensively encrypt all enterprise data.

Furthermore, the RTM Locker Linux encryptor seems to be designed explicitly for assaulting VMware ESXi systems, given the numerous references to commands employed in VM administration.

Ransom Note

As part of its file encryption routine, the encryptor modifies the names of the affected files by appending the “.RTM” extension.

Following the completion of the encryption process, the malware proceeds to generate ransom notes on the compromised system, which are typically labeled as:-

  • “!!! Warning !!!”

After encrypting the victim’s files and appending the “.RTM” extension to their names, the ransom notes issued by the attackers typically contain threats to publish the stolen data if the victim fails to pay a ransom. 

These notes also instruct the victim to contact RTM’s “support” within 48 hours via the anonymous messaging platform Tox to initiate negotiations for the ransom payment.

Ransom note

Historically, RTM Locker relied on TOR payment negotiation sites to communicate with victims and demand ransom payments. 

However, the attackers have recently shifted their communication strategy and begun using the anonymous messaging platform TOX.

The development and deployment of an ESXi-targeting variant of the RTM Locker ransomware indicate that this threat actor poses a significant risk to enterprise-level organizations.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus


Gurubaran is a Security Consultant, Security Editor & Co-Founder of Cyber Security News & GBHackers On Security.

Recent Posts

SSNDOB Marketplace Admin Jailed for Selling millions of Americans Data

In a resounding triumph for justice, U.S. District Judge Kathryn Kimball Mizelle has sentenced Vitalii…

10 hours ago

Is Your Online Store Hacked in a Carding Attack? Here’s an Action Plan to Protect

Hackers are plotting to benefit from the generosity of Halloween, Thanksgiving, and Christmas shoppers using…

14 hours ago

Google Researchers Find Out How ChatGPT Queries Can Collect Personal Data

The LLMs (Large Language Models) are evolving rapidly with continuous advancements in their research and…

14 hours ago

New Android Malware Employs Various Tactics to Deceive Malware Analyst

In the dynamic realm of mobile application security, cybercriminals employ ever more sophisticated forms of…

16 hours ago

DJvu Ransomware Mimic as Cracked Software to Compromise Computers

A recent campaign has been observed to be delivering DJvu ransomware through a loader that…

17 hours ago

Okta Hack: Threat Actors Downloaded all Customer Support System Users’ Data

In a pivotal update to the Okta security incident divulged in October 2023, Okta Security…

18 hours ago