SEXi ransomware rebrands to APT INC, continues VMware ESXi attacks

Share:

The SEXi ransomware operation, known for targeting VMware ESXi servers, has rebranded under the name APT INC and has targeted numerous organizations in recent attacks.

The threat actors started attacking organizations in February 2024 using the leaked Babuk encryptor to target VMware ESXi servers and the leaked LockBit 3 encryptor to target Windows.

The cybercriminals soon gained media attention for a massive attack on IxMetro Powerhost, a Chilean hosting provider whose VMware ESXi servers were encrypted in the attack.

The ransomware operation was given the name SEXi based on the SEXi.txt ransom note name and the .SEXi extension in the names of encrypted files.

Cybersecurity researcher Will Thomas later found other variants that use the names SOCOTRA, FORMOSA, and LIMPOPO.

While the ransomware operation utilizes both Linux and Windows encryptors, it is known for targeting VMware ESXi servers.

Rebrands as APT INC

Since June, the ransomware operation has rebranded as APT INC, with cybersecurity researcher Rivitna telling BleepingComputer they continue to use the Babuk and LockBit 3 encryptors.

Over the past two weeks, numerous APT INC victims have contacted BleepingComputer or posted in our forums to share similar experiences regarding their attacks.

The threat actors gain access to the VMware ESXi servers and encrypt files related to the virtual machines, such as virtual disks, storage, and backup images.  The other files on the operating system are not encrypted.

Each victim will be assigned a random name that is not affiliated with the company. This name is used for the ransom note names and the encrypted file extension.

These ransom notes contain information on contacting the threat actors using the Session encrypted messaging application. Note how the Session address of 05c5dbb3e0f6c173dd4ca479587dbeccc1365998ff9042581cd294566645ec7912 is the same one used in the SEXi ransom notes.

BleepingComputer has learned that ransom demands vary between tens of thousands to millions, with the CEO of IxMetro Powerhost publicly stating that the threat actors demanded two bitcoins per encrypted customer.

Unfortunately, the Babuk and LockBit 3 encryptors are secure and have no known weaknesses, so there is no free way to recover files.

The leaked Babuk and LockBit 3 encryptors have been used to power new ransomware operations, including APT INC. The leaked Babuk encryptors have been widely adopted as they include an encryptor that targets VMware ESXi servers, which is heavily used in the enterprise.

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
4:09 am, Jul 11, 2025
weather icon 18°C
L: 16° | H: 19°
scattered clouds
Humidity: 80 %
Pressure: 1021 mb
Wind: 5 mph E
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 45%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:56 am
Sunset: 9:15 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
16° | 19°°C 0 mm 0% 8 mph 76 % 1021 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
19° | 30°°C 0 mm 0% 10 mph 66 % 1019 mb 0 mm/h
Sun Jul 13 10:00 pm
weather icon
18° | 30°°C 0 mm 0% 7 mph 71 % 1015 mb 0 mm/h
Mon Jul 14 10:00 pm
weather icon
18° | 28°°C 1 mm 100% 15 mph 84 % 1016 mb 0 mm/h
Tue Jul 15 10:00 pm
weather icon
14° | 20°°C 1 mm 100% 14 mph 81 % 1017 mb 0 mm/h
Today 7:00 am
weather icon
18° | 19°°C 0 mm 0% 2 mph 76 % 1021 mb 0 mm/h
Today 10:00 am
weather icon
24° | 27°°C 0 mm 0% 2 mph 57 % 1021 mb 0 mm/h
Today 1:00 pm
weather icon
30° | 30°°C 0 mm 0% 3 mph 32 % 1020 mb 0 mm/h
Today 4:00 pm
weather icon
32° | 32°°C 0 mm 0% 4 mph 26 % 1018 mb 0 mm/h
Today 7:00 pm
weather icon
30° | 30°°C 0 mm 0% 6 mph 29 % 1017 mb 0 mm/h
Today 10:00 pm
weather icon
23° | 23°°C 0 mm 0% 8 mph 49 % 1019 mb 0 mm/h
Tomorrow 1:00 am
weather icon
21° | 21°°C 0 mm 0% 5 mph 57 % 1019 mb 0 mm/h
Tomorrow 4:00 am
weather icon
19° | 19°°C 0 mm 0% 5 mph 66 % 1018 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€99,711.92
4.88%
Ethereum(ETH)
€2,534.30
6.46%
Tether(USDT)
€0.85
-0.01%
XRP(XRP)
€2.21
6.74%
Solana(SOL)
€140.98
4.20%
USDC(USDC)
€0.85
-0.01%
Dogecoin(DOGE)
€0.169861
9.70%
Shiba Inu(SHIB)
€0.000012
9.28%
Pepe(PEPE)
€0.000011
15.02%
Peanut the Squirrel(PNUT)
€0.248685
22.27%
Scroll to Top