

We also observed two clusters of activity. However, in July, we observed a Linux variant of HelloKitty targeting VMware’s ESXi hypervisor, which is widely used in cloud and on-premises data centers.

#CRYPTO LOCKER FILE VARIANTS MONITOR WINDOWS#
HelloKitty is not a new ransomware group it can be tracked as early as 2020, mainly targeting Windows systems.Hive uses all tools available in the extortion toolset to create pressure on the victim, including the date of initial compromise, countdown, the date the leak was actually disclosed on their site, and even the option to share the disclosed leak on social media. Since then, Hive has impacted 28 organizations that are now listed on the group’s extortion site, including a European airline company and three U.S.-based organizations. Hive Ransomware is double-extortion ransomware that started operations in June.We have observed initial ransom demands ranging from $50,000 to $75,000. This ransomware also has an extortion site, which claims to have impacted six organizations in the following countries: the U.S., the U.K., the U.A.E., Belgium, Spain and Lebanon.
#CRYPTO LOCKER FILE VARIANTS MONITOR SOFTWARE#
Like many of its competitors, AvosLocker offers technical support to help victims recover after they’ve been attacked with encryption software that the group claims is “fail-proof,” has low detection rates and is capable of handling large files.

AvosLocker was observed promoting its RaaS program and looking for affiliates on dark web discussion forums and other forums.
