SEXi ransomware rebrands to APT INC, continues VMware ESXi attacks

Teilen:

The SEXi ransomware operation, known for targeting VMware ESXi servers, has rebranded under the name APT INC and has targeted numerous organizations in recent attacks.

The threat actors started attacking organizations in February 2024 using the leaked Babuk encryptor to target VMware ESXi servers and the leaked LockBit 3 encryptor to target Windows.

The cybercriminals soon gained media attention for a massive attack on IxMetro Powerhost, a Chilean hosting provider whose VMware ESXi servers were encrypted in the attack.

The ransomware operation was given the name SEXi based on the SEXi.txt ransom note name and the .SEXi extension in the names of encrypted files.

Cybersecurity researcher Will Thomas later found other variants that use the names SOCOTRA, FORMOSA, and LIMPOPO.

While the ransomware operation utilizes both Linux and Windows encryptors, it is known for targeting VMware ESXi servers.

Rebrands as APT INC

Since June, the ransomware operation has rebranded as APT INC, with cybersecurity researcher Rivitna telling BleepingComputer they continue to use the Babuk and LockBit 3 encryptors.

Over the past two weeks, numerous APT INC victims have contacted BleepingComputer or posted in our forums to share similar experiences regarding their attacks.

The threat actors gain access to the VMware ESXi servers and encrypt files related to the virtual machines, such as virtual disks, storage, and backup images.  The other files on the operating system are not encrypted.

Each victim will be assigned a random name that is not affiliated with the company. This name is used for the ransom note names and the encrypted file extension.

These ransom notes contain information on contacting the threat actors using the Session encrypted messaging application. Note how the Session address of 05c5dbb3e0f6c173dd4ca479587dbeccc1365998ff9042581cd294566645ec7912 is the same one used in the SEXi ransom notes.

BleepingComputer has learned that ransom demands vary between tens of thousands to millions, with the CEO of IxMetro Powerhost publicly stating that the threat actors demanded two bitcoins per encrypted customer.

Unfortunately, the Babuk and LockBit 3 encryptors are secure and have no known weaknesses, so there is no free way to recover files.

The leaked Babuk and LockBit 3 encryptors have been used to power new ransomware operations, including APT INC. The leaked Babuk encryptors have been widely adopted as they include an encryptor that targets VMware ESXi servers, which is heavily used in the enterprise.

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
4:07 am, Juli 14, 2025
Wetter-Symbol 19°C
L: 17° | H: 20°
light rain
Luftfeuchtigkeit: 74 %
Druck: 1011 mb
Wind: 5 mph SSE
Windböe: 0 mph
UV-Index: 0
Niederschlag: 0.24 mm
Wolken: 100%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 4:59 am
Sonnenuntergang: 9:12 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 10:00 pm
Wetter-Symbol
17° | 20°°C 0 mm 0% 18 mph 76 % 1015 mb 0 mm/h
Tomorrow 10:00 pm
Wetter-Symbol
15° | 20°°C 1 mm 100% 15 mph 78 % 1016 mb 0 mm/h
Mi. Juli 16 10:00 pm
Wetter-Symbol
14° | 27°°C 0.2 mm 20% 14 mph 73 % 1017 mb 0 mm/h
Do. Juli 17 10:00 pm
Wetter-Symbol
18° | 26°°C 1 mm 100% 8 mph 80 % 1017 mb 0 mm/h
Fr. Juli 18 10:00 pm
Wetter-Symbol
19° | 30°°C 0 mm 0% 12 mph 79 % 1015 mb 0 mm/h
Today 7:00 am
Wetter-Symbol
17° | 19°°C 0 mm 0% 9 mph 76 % 1011 mb 0 mm/h
Today 10:00 am
Wetter-Symbol
20° | 20°°C 0 mm 0% 11 mph 59 % 1012 mb 0 mm/h
Today 1:00 pm
Wetter-Symbol
23° | 23°°C 0 mm 0% 15 mph 39 % 1013 mb 0 mm/h
Today 4:00 pm
Wetter-Symbol
25° | 25°°C 0 mm 0% 18 mph 28 % 1013 mb 0 mm/h
Today 7:00 pm
Wetter-Symbol
22° | 22°°C 0 mm 0% 15 mph 30 % 1013 mb 0 mm/h
Today 10:00 pm
Wetter-Symbol
19° | 19°°C 0 mm 0% 9 mph 45 % 1015 mb 0 mm/h
Tomorrow 1:00 am
Wetter-Symbol
16° | 16°°C 0 mm 0% 8 mph 61 % 1016 mb 0 mm/h
Tomorrow 4:00 am
Wetter-Symbol
15° | 15°°C 0 mm 0% 8 mph 72 % 1016 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€102,450.71
1.74%
Ethereum(ETH)
€2,568.36
1.64%
XRP(XRP)
€2.47
4.21%
Fesseln(USDT)
€0.86
0.00%
Solana(SOL)
€141.15
2.36%
USDC(USDC)
€0.86
0.00%
Dogecoin(DOGE)
€0.172468
1.83%
Shiba Inu(SHIB)
€0.000012
2.16%
Pepe(PEPE)
€0.000011
2.78%
Peanut das Eichhörnchen(PNUT)
€0.244556
5.81%
Nach oben scrollen