{"id":8446,"date":"2025-11-14T10:03:39","date_gmt":"2025-11-14T10:03:39","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/11\/14\/kraken-cross-platform-ransomware-attacking-windows-linux-and-vmware-esxi-systems-in-enterprise-environments\/"},"modified":"2025-11-14T10:03:39","modified_gmt":"2025-11-14T10:03:39","slug":"kraken-cross-platform-ransomware-attacking-windows-linux-and-vmware-esxi-systems-in-enterprise-environments","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/11\/14\/kraken-cross-platform-ransomware-attacking-windows-linux-and-vmware-esxi-systems-in-enterprise-environments\/","title":{"rendered":"Kraken Cross-Platform Ransomware Attacking Windows, Linux, and VMware ESXi Systems in Enterprise Environments"},"content":{"rendered":"

Kraken Cross-Platform Ransomware Attacking Windows, Linux, and VMware ESXi Systems in Enterprise Environments
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

In August 2025, a new ransomware threat emerged with capabilities that fundamentally changed how organizations should approach enterprise security.<\/p>\n

Kraken, a Russian-speaking cybercriminal group, began executing sophisticated attacks targeting large organizations across multiple continents.<\/p>\n

What makes Kraken particularly dangerous is its ability to attack Windows, Linux, and VMware ESXi systems with platform-specific tools, making it one of the first truly cross-platform ransomware threats to gain widespread notoriety in enterprise circles.<\/p>\n

The Kraken group appears to be connected to the HelloKitty<\/a> ransomware operation, with security researchers suspecting the group emerged from the remnants of that previous criminal organization.<\/p>\n

\n
\"Kraken
Kraken data leak blog (Source \u2013 Cisco Talos)<\/figcaption><\/figure>\n<\/div>\n

This connection becomes evident through shared ransom note filenames and explicit references on the group\u2019s leak site.<\/p>\n

\n
\"Kraken
Kraken ransom note (Source \u2013 Cisco Talos)<\/figcaption><\/figure>\n<\/div>\n

In September 2025, Kraken announced a new underground forum called \u201cThe Last Haven Board,\u201d designed to create a secure communication hub for the cybercriminal community.<\/p>\n

Notably, HelloKitty operators announced their support for this new platform, solidifying the link between these groups.<\/p>\n

Cisco Talos security analysts identified<\/a> Kraken conducting double-extortion attacks in which victims are both encrypted and threatened with data publication.<\/p>\n

The group employs a sophisticated multi-stage attack methodology that begins with SMB vulnerability exploitation on internet-exposed servers.<\/p>\n

\n
\"Kraken
Kraken infection chain (Source \u2013 Cisco Talos)<\/figcaption><\/figure>\n<\/div>\n

Once inside a system, attackers steal privileged credentials and use them to maintain persistent access through Remote Desktop Protocol connections.<\/p>\n

To establish long-term presence, attackers deploy Cloudflared for creating reverse tunnels and SSH Filesystem tools for data exfiltration<\/a>.<\/p>\n

Before deploying encryption, the ransomware<\/a> performs a unique benchmarking operation to measure how fast it can operate on the victim\u2019s machine without causing immediate detection through system resource exhaustion.<\/p>\n

Encryption and Command-Line Flexibility<\/strong><\/h2>\n

Kraken\u2019s technical sophistication becomes apparent through its extensive command-line options. The ransomware uses RSA-4096 and ChaCha20 encryption algorithms, providing strong cryptographic protection.<\/p>\n

Attackers can customize attacks using parameters like timeout delays, file size limits, and encryption depth selections.<\/p>\n

For Windows systems, the command format follows: Encryptor.exe \u2013key <32-byte key> -path <targeted path> -t<\/code>.<\/p>\n

Linux and ESXi versions use ELF binaries with options like daemon mode execution and SSH remote capabilities.<\/p>\n

The ransomware features partial and full encryption modes, allowing attackers to optimize between encryption speed and maximum damage.<\/p>\n

Notably, Kraken actively encrypts SQL databases<\/a> and network shares while automatically skipping critical system files and Program Files directories to maintain victim system functionality for ransom negotiations.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post Kraken Cross-Platform Ransomware Attacking Windows, Linux, and VMware ESXi Systems in Enterprise Environments<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Kraken Cross-Platform Ransomware Attacking Windows, Linux, and VMware ESXi Systems in Enterprise Environments In August 2025, a new ransomware threat emerged with capabilities that fundamentally changed how organizations should approach enterprise security. Kraken, a Russian-speaking cybercriminal group, began executing sophisticated attacks targeting large organizations across multiple continents. What makes Kraken particularly dangerous is its ability […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-8446","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8446"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=8446"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8446\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=8446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=8446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=8446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}