New Play Ransomware Linux Variant Targets ESXi Shows Ties With Prolific Puma

MITRE Techniques

• [T1568.002] Dynamic Resolution: Domain Generation Algorithms – The ransomware infrastructure uses domain generation algorithms (DGAs) to create domains for C2 communication, as evidenced by Prolific Puma’s domain activities. “The ransomware infrastructure uses domain generation algorithms (DGAs) to create domains for C2 communication, as evidenced by Prolific Puma’s domain activities.”
• [T1105] Ingress Tool Transfer – The ransomware downloads and executes tools from malicious domains, including PsExec, NetScan, WinRAR, and others. “downloads and executes tools like PsExec, NetScan, WinRAR, and others from malicious domains.”
• [T1570] Lateral Tool Transfer – The Play ransomware may transfer tools like PsExec, NetScan, and others across the network to facilitate its attack. “The Play ransomware may transfer tools like PsExec, NetScan, and others across the network to facilitate its attack.”
• [T1059.004] Command and Scripting Interpreter: Unix Shell – The ransomware uses Unix shell commands to execute its payload and control the ESXi environment. “The ransomware uses Unix shell commands to execute its payload and control the ESXi environment.”
• [T1046] Network Service Discovery – The ransomware uses commands like vim-cmd and esxcli to discover and interact with services on the ESXi environment. “The ransomware uses commands like vim-cmd and esxcli to discover and interact with services on the ESXi environment.”
• [T1083] File and Directory Discovery – The ransomware scans for files and directories to encrypt, specifically targeting VM files and configurations. “The ransomware scans for files and directories to encrypt, specifically targeting VM files and configurations.”
• [T1486] Data Encrypted for Impact – The ransomware encrypts files and VM files within the ESXi environment to disrupt operations and demand a ransom. “encrypts files and VM files within the ESXi environment to disrupt operations and demand a ransom.”
• [T1491.001] Defacement: Internal Defacement – The ransomware alters system messages or displays ransom notes to inform the victim of the encryption and extortion. “Defacement: Internal Defacement.”
• [T1489] Service Stop – The ransomware stops ESXi services and powers off VMs as part of its attack to maximize impact and prevent recovery. “The ransomware stops ESXi services and powers off VMs as part of its attack to maximize impact and prevent recovery.”
• [T1041] Exfiltration over C2 Channel – The ransomware may exfiltrate data over its command and control channels, especially when encrypting or managing VM files. “Exfiltration over C&C Channel.”
• [T1070.004] File Deletion – The ransomware deletes specific files or logs to avoid detection or cleanup after executing its payload. “File Deletion.”