RTM Locker ransomware targets VMware ESXi servers
Archived: 2026-04-10 02:53:45 UTC
Target Industry
Indiscriminate, opportunistic targeting.
Overview
The threat actor group, tracked as Read The Manual (RTM) Locker, has been detected targeting virtual machines
on VMware ESXi servers via the deployment of a Linux encryptor. Analysis of the associated malware indicates
that the encryptor has been crafted specifically for targeting VMware ESXi systems due to the linked commands
used to manage virtual machines.
Impact
Successful exploitation by RTM Locker ransomware will result in the encryption and exfiltration of significant
amounts of data held on the compromised device or system before a ransom of a predetermined amount is issued.
The ransom fee demanded will almost certainly depend on the estimated value of the compromised organisation.
Encrypted data may include private customer data, corporate finance data and system credentials. The double
extortion strategy employed by the group will almost certainly result in all stolen data being published to dark web
forums, where there is a realistic possibility that stolen data will be used for initial compromise in future attacks.
Incident Detection
The encryptor appends the “.RTM” file extension to the encrypted file names. Ransom notes are then created with
the name, “!!! Warning !!!” on the target system.
Affected Products
VMware ESXi servers
Containment, Mitigations & Remediations
To mitigate against ransomware attacks, technical controls should be explored. These controls could encompass
the enforcement of multi-factor authentication (MFA) for all users, conditional access policies and web proxies
filtering on low- or non-reputation domains.
A primary method of reducing the threat posed by RTM ransomware is to detect it in the early stages using an
effective and monitored endpoint detection and response (EDR) solution. An effective EDR tool, such as the
Microsoft Defender suite, will block ransomware attempts once detected.
https://www.quorumcyber.com/threat-intelligence/rtm-locker-ransomware-targets-vmware-esxi-servers/
Page 1 of 4

Organisations can also perform routine back-ups of sensitive data that is required for business operations and to
keep a copy offline in case back-ups are impacted by the attack. Therefore, if a breach occurs and the business can
no longer function, a back-up is ready to use, and the business can continue to operate with minimal disruption.
However, this does not nullify the fact that customer and employee data may have also been lost, and potentially
released because the Clop ransomware group operates via double or triple extortion.
Indicators of Compromise
RTM associated file hashes (SHA1):
– f4c746696b0f5bb565d445ec49dd912993de6361
– 025c718ba31e43db1b87dc13f94a61a9338c11ce
– 03de8622be6b2f75a364a275995c3411626c4d9f
– 094ac3c414a9e6028afa5cdc0d4b4f3aa98b92ca
– 1e4b84be1e4287c9787cd56009e1e2adb3348db8
– 42a4b04446a20993ddae98b2be6d5a797376d4b6
– 6cf45111b2d71862803cf91f2a79780149c46a27
– 6f036c802384826b630aec70d9833b5b0ed735eb
– 8966319882494077c21f66a8354e2cbca0370464
– 9ac461ef9848367f46bf64649d46de955c4afc66
– af862050a01972db36589653dc8b155e2b3e2f8c
– b1ee562e1f69efc6fba58b88753be7d0b3e4cfab
– c6e3aa123a52762bf2690b97cc79148eedd0e1e0
– daa0673cb1d3eb7dbe8aa435997ecd9e1da228fd
– df1a4c99791570a2d203075581a6aeef59ece02b
– f89e56dd9ca78cec02d0a2b95803843c59234082
– fca3d02a53e66d8975997ff2b03c8008a254a508
– 00fe6cf9c85821a2a2479083acb538ee49c8c141
– 2f6fd3b5a7611d72f9f9eb60b04471f9bebc738f
– 471a8fd0aa32ce61cf5e4ebece95527d1b234de6
RTM associated domains:
– micro4n[.]top
– vpntap[.]top
– vpnkeep[.]bit
– vpnomnet[.]bit
– webstatisticaonline[.]tech
– cainmoon[.]net
– cash-money-analitica[.]bit
– d47ea26b7faa[.]bit
– fde05d0573da[.]bit
– feb96eb2aa59[.]bit
– money-cash-analitica[.]bit
https://www.quorumcyber.com/threat-intelligence/rtm-locker-ransomware-targets-vmware-esxi-servers/
Page 2 of 4

– rtm[.]dev
– ssdcool[.]top
RTM associated IP addresses:
– 185[.]141[.]27[.]249
– 185[.]82[.]216[.]14
– 188[.]138[.]71[.]117
– 158[.]255[.]208[.]197
– 185[.]169[.]229[.]42
– 185[.]61[.]149[.]78
– 5[.]154[.]191[.]57
– 91[.]207[.]7[.]69
– 95[.]183[.]52[.]182
– 109[.]236[.]82[.]150
– 109[.]248[.]32[.]152
– 131[.]72[.]138[.]169
– 154[.]70[.]153[.]125
– 158[.]255[.]6[.]150
– 185[.]128[.]42[.]237
– 185[.]61[.]149[.]70
– 185[.]82[.]201[.]45
– 200[.]74[.]240[.]134
– 212[.]48[.]90[.]155
– 213[.]184[.]127[.]137
Threat Landscape
It was recently reported by Trellix that RTM Locker had launched a new Ransomware-as-a-Service (RaaS)
operation and had started recruiting affiliates, including those from the former Conti cybercrime syndicate. At the
time of the initial reporting, only a Windows ransomware encryptor had been discovered. However, RTM has now
expanded its mode of operation to target VMware ESXi servers.
VMware has a significant proportion of the virtualisation market. Given that threat actors generally utilise a
combination of probability and asset value to determine which attack surfaces to focus on, VMware products have
become a prime target for threat actors. Due to the fact that virtual machines have become an integral aspect of
both personal and business affairs, threat actors will continue to exploit vulnerabilities contained within the
associated devices in an attempt to extract the sensitive information contained therein.
Threat Group
The RTM cybercrime group has been observed to target remote banking systems, primarily in Russia. The group
uses drive-by downloads and spam with attachments of fake contracts, invoices or tax forms to deliver a custom
malware (RTM Banking Trojan) that targets accounting software and is used for the purposes of financial gain.
https://www.quorumcyber.com/threat-intelligence/rtm-locker-ransomware-targets-vmware-esxi-servers/
Page 3 of 4

Further, the group operates within the confines of a RaaS model, whereby other threat actors are recruited to
become affiliates. This indicates that the group is associated with a high level of sophistication and organisation
and, as such, should be considered as a significant threat.
Mitre Methodologies
Execution Technique:
T1106 – Native API
Privilege Escalation Technique:
T1134.002 – Access Token Manipulation: Create Process with Token
Defense Evasion Techniques:
T1070.001– Indicator Removal: Clear Windows Event Logs
T1070.004 – Indicator Removal: File Deletion
T1134.002 – Access Token Manipulation: Create Process with Token
Discovery Technique:
T1057 – Process Discovery
Collection Technique:
T1005 – Data from Local System
Impact Techniques:
T1486 – Data Encrypted for Impact
T1489 – Service Stop
Further Information
Trellix Report
Source: https://www.quorumcyber.com/threat-intelligence/rtm-locker-ransomware-targets-vmware-esxi-servers/
https://www.quorumcyber.com/threat-intelligence/rtm-locker-ransomware-targets-vmware-esxi-servers/
Page 4 of 4