IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Linux-based multi-cloud environments facing increased ransomware attacks

VMware researchers claim not enough effort is being spent on developing countermeasures for attacks on the cloud's most popular operating system

Research from VMware Threat Analysis Unit (VMware TAU) has revealed cyber attackers are increasingly targeting Linux-based multi-cloud environments to install malware such as ransomware, remote access tools (RATs), and cryptominers.

Ransomware operators have evolved recently and are now targeting Linux host images used to execute workloads in virtualised environments, the researchers said, with common ransomware families spotted in compromised environments including Defray777 and DarkSide - the latter of which was used in the notorious Colonial Pipeline hack in 2021.

The findings mark an emerging trend whereby attackers are increasingly targeting Linux to gain a foothold in a business to deliver financially-motivated malware campaigns.

VMware TAU also said Linux-based malware is becoming more "sophisticated" and "devastating" with attackers scoping out companies tackling "financial events" to incentivise payments, as well as fully compromising cloud environments before encrypting files to make the incident response more difficult.

The researchers noted that traditional malware countermeasures are typically focused on protection for Windows environments, meaning adequate attention isn't being paid to Linux thus leaving public and private clouds more vulnerable.

According to VMware TAU, more than 75% of the most popular websites today are powered by Linux and it's also the most popular cloud operating system, comprising a core part of a business' digital infrastructure. 

"Cyber criminals are dramatically expanding their scope and adding malware that targets Linux-based operating systems to their attack toolkit in order to maximise their impact with as little effort as possible,” said Giovanni Vigna, senior director of threat intelligence at VMware.

"Attackers view both public and private clouds as high-value targets due to the access they provide to critical infrastructure services and confidential data," he added.

RATs such as the commercial penetration testing tool Cobalt Strike and a Linux-based re-implementation of a Beacon payload related to it, known as Vermillion Strike, are commonly used as the primary implant in cyber attacks on multi-cloud environments.

Cobalt Strike is a tool used for good by penetration testers and in red team exercises to simulate real attacks but is often misused by cyber criminals for malicious hacking purposes.

Related Resource

The best defence against ransomware

How ransomware is evolving and how to defend against it

Blue padlock Free download

Vermillion Strike was discovered in 2021 and is a malware that allows operators to communicate with victims' machines after infection via a command and control (C2) server. It allows attackers to perform various actions including executing commands and modifying files, making it an ideal tool for attackers looking to encrypt files in extortion campaigns.

"In order to gain control and persist within an environment, attackers look to install an implant on a compromised system that gives them partial control of the machine," said VMware TAU. "Malware, web shells, and Remote Access Tools (RATs) can all be implants used by attackers in a compromised system to allow for remote access."

VMware TAU also noted in its research that cryptomining was also an issue affecting organisations running multi-cloud environments, with Monero being the most popular asset being mined using victims' infrastructure. 

It follows a similar claim made by Google Cloud recently; it noticed a large number of compromises of its customers' environments often led to cryptominers being installed to harness scalable compute without incurring any cost to the attackers.

"Since we conducted our analysis, even more ransomware families were observed gravitating to Linux-based malware, with the potential for additional attacks that could leverage the Log4j vulnerabilities," said Brian Baskin, manager of threat research at VMware.

"The findings in this report can be used to better understand the nature of Linux-based malware and mitigate the growing threat that ransomware, cryptomining, and RATs have on multi-cloud environments. As attacks targeting the cloud continue to evolve, organisations should adopt a Zero Trust approach to embed security throughout their infrastructure and systematically address the threat vectors that make up their attack surface."

Featured Resources

ZTNA vs on-premises VPN

How ZTNA wins the network security game

Free Download

The global use of collaboration solutions in hybrid working environments

How companies manage security risks

Free Download

How to build a cyber-resilient business ready to innovate and thrive

Outperform your peers in your successful business outcomes

Free Download

Accelerating your IT transformation

How Cloudflare is innovating for CIOs to start 2023

Watch now


Analysing the economic benefits of Trend Micro Vision One

Analysing the economic benefits of Trend Micro Vision One

16 Mar 2023
Kali Linux releases first-ever defensive distro with score of new tools
enterprise security

Kali Linux releases first-ever defensive distro with score of new tools

14 Mar 2023
Mint vs Ubuntu: Which one is better?
operating systems

Mint vs Ubuntu: Which one is better?

10 Mar 2023
Linux edges closer to full Apple silicon support with version 6.2
operating systems

Linux edges closer to full Apple silicon support with version 6.2

21 Feb 2023

Most Popular

Tech pioneers call for six-month pause of "out-of-control" AI development
artificial intelligence (AI)

Tech pioneers call for six-month pause of "out-of-control" AI development

29 Mar 2023
Getting the best value from your remote support software
Advertisement Feature

Getting the best value from your remote support software

13 Mar 2023
3CX CEO confirms supply chain malware attack

3CX CEO confirms supply chain malware attack

30 Mar 2023