Rise in Attacks Against ESXi: Babuk Source Code Inspires Nine Different Ransomware Strains

15 May 2023
SentinelLabs detected 10 ransomware families employing VMware ESXi lockers, derived from the leaked 2021 Babuk source code. These variants emerged between H2 2022 and H1 2023. The report also highlights similarities between Babuk's source code and the ESXi encrypters used by Conti and REvil, indicating some connection between them.