SEXiThreat actor
SEXi is a ransomware group that targets VMware ESXi servers, encrypting data and demanding ransom payments. They have been observed encrypting virtual machines and backups, causing significant disruptions to services. The group's name is a play on the word "ESXi," indicating a deliberate focus on these systems. SEXi has been linked to other ransomware variants based on the Babuk source code.From MISP Galaxy
Last reported 2 years ago, by Group-IB1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1027.014Polymorphic Code
“With its constantly evolving, polymorphic code that evades traditional security measures, Eldorado Ransomware demands strong cybersecurity practices, continuous monitoring, and swift incident response to mitigate its potentially devastating impact.”
- T1219Remote Access Tools
“It exploits vulnerabilities via phishing, unpatched software, and remote access tools.”
What the reports say
1 report, newest first · the exact sentence from each-
Eldorado Ransomware: The New Golden Empire of Cybercrime?“Notable examples include the LIMPOPO (aka SOCOTRA, FORMOSA, SEXi) ransomware group, BabLock ransomware, and Estate ransomware.”
Indicators in its reports
named in the reports above- main[.]ecin 1 report
- 173.44.141[.]152in 1 report
- ntdetect[.]comin 1 report
- 1375e5d7f672bfd4…f6eb0ab9f27bin 1 report
- 7f21d5c966f4fd1a…f3f122ae66ddin 1 report
- cb0b9e509a0f16eb…8d96736174a7in 1 report
- b2266ee3c6780918…d379f12c70dein 1 report
- dc4092a476c29b85…a01f22258c33in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.