SEXi ransomware rebrands to APT INC, continues VMware ESXi attacks

Teilen:

The SEXi ransomware operation, known for targeting VMware ESXi servers, has rebranded under the name APT INC and has targeted numerous organizations in recent attacks.

The threat actors started attacking organizations in February 2024 using the leaked Babuk encryptor to target VMware ESXi servers and the leaked LockBit 3 encryptor to target Windows.

The cybercriminals soon gained media attention for a massive attack on IxMetro Powerhost, a Chilean hosting provider whose VMware ESXi servers were encrypted in the attack.

The ransomware operation was given the name SEXi based on the SEXi.txt ransom note name and the .SEXi extension in the names of encrypted files.

Cybersecurity researcher Will Thomas later found other variants that use the names SOCOTRA, FORMOSA, and LIMPOPO.

While the ransomware operation utilizes both Linux and Windows encryptors, it is known for targeting VMware ESXi servers.

Rebrands as APT INC

Since June, the ransomware operation has rebranded as APT INC, with cybersecurity researcher Rivitna telling BleepingComputer they continue to use the Babuk and LockBit 3 encryptors.

Over the past two weeks, numerous APT INC victims have contacted BleepingComputer or posted in our forums to share similar experiences regarding their attacks.

The threat actors gain access to the VMware ESXi servers and encrypt files related to the virtual machines, such as virtual disks, storage, and backup images.  The other files on the operating system are not encrypted.

Each victim will be assigned a random name that is not affiliated with the company. This name is used for the ransom note names and the encrypted file extension.

These ransom notes contain information on contacting the threat actors using the Session encrypted messaging application. Note how the Session address of 05c5dbb3e0f6c173dd4ca479587dbeccc1365998ff9042581cd294566645ec7912 is the same one used in the SEXi ransom notes.

BleepingComputer has learned that ransom demands vary between tens of thousands to millions, with the CEO of IxMetro Powerhost publicly stating that the threat actors demanded two bitcoins per encrypted customer.

Unfortunately, the Babuk and LockBit 3 encryptors are secure and have no known weaknesses, so there is no free way to recover files.

The leaked Babuk and LockBit 3 encryptors have been used to power new ransomware operations, including APT INC. The leaked Babuk encryptors have been widely adopted as they include an encryptor that targets VMware ESXi servers, which is heavily used in the enterprise.

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
8:59 am, Juli 9, 2025
Wetter-Symbol 19°C
L: 17° | H: 20°
klarer Himmel
Luftfeuchtigkeit: 66 %
Druck: 1021 mb
Wind: 6 mph WNW
Windböe: 0 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 3%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 4:54 am
Sonnenuntergang: 9:16 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 10:00 pm
Wetter-Symbol
17° | 20°°C 0.88 mm 88% 6 mph 66 % 1022 mb 0 mm/h
Tomorrow 10:00 pm
Wetter-Symbol
18° | 30°°C 0 mm 0% 8 mph 76 % 1023 mb 0 mm/h
Fr. Juli 11 10:00 pm
Wetter-Symbol
19° | 29°°C 0 mm 0% 8 mph 56 % 1022 mb 0 mm/h
Sa. Juli 12 10:00 pm
Wetter-Symbol
19° | 30°°C 0 mm 0% 10 mph 68 % 1019 mb 0 mm/h
So. Juli 13 10:00 pm
Wetter-Symbol
18° | 31°°C 0 mm 0% 10 mph 68 % 1016 mb 0 mm/h
Today 10:00 am
Wetter-Symbol
19° | 20°°C 0 mm 0% 5 mph 66 % 1021 mb 0 mm/h
Today 1:00 pm
Wetter-Symbol
20° | 23°°C 0 mm 0% 6 mph 63 % 1021 mb 0 mm/h
Today 4:00 pm
Wetter-Symbol
24° | 26°°C 0.88 mm 88% 4 mph 54 % 1021 mb 0 mm/h
Today 7:00 pm
Wetter-Symbol
25° | 25°°C 0.31 mm 31% 3 mph 51 % 1021 mb 0 mm/h
Today 10:00 pm
Wetter-Symbol
22° | 22°°C 0 mm 0% 3 mph 57 % 1022 mb 0 mm/h
Tomorrow 1:00 am
Wetter-Symbol
21° | 21°°C 0 mm 0% 2 mph 67 % 1022 mb 0 mm/h
Tomorrow 4:00 am
Wetter-Symbol
18° | 18°°C 0 mm 0% 3 mph 76 % 1022 mb 0 mm/h
Tomorrow 7:00 am
Wetter-Symbol
19° | 19°°C 0 mm 0% 3 mph 69 % 1023 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€92,741.88
0.27%
Ethereum(ETH)
€2,238.28
2.80%
Fesseln(USDT)
€0.85
0.00%
XRP(XRP)
€1.99
2.65%
Solana(SOL)
€130.48
2.31%
USDC(USDC)
€0.85
-0.01%
Dogecoin(DOGE)
€0.146621
2.00%
Shiba Inu(SHIB)
€0.000010
1.34%
Pepe(PEPE)
€0.000009
3.04%
Nach oben scrollen