Cicada3301 ransomware targets VMWare ESXi servers, employing double extortion tactics by encrypting data and threatening to expose it unless a ransom is paid.
After penetrating corporate networks, attackers use remote access tools to execute ransomware, shutting down VMs and employing strong encryption methods to lock files.
The targeted data includes various file types, suggesting the ransomware was adapted from Windows systems, showcasing a broad risk across industries like healthcare and manufacturing.
Cicada3301 has publicly listed at least 20 victims since launching its ransomware service, indicating a systemic threat to diverse sectors mainly in North America and England.
[
Collection
]
[
|
...
]