{"id":54356,"date":"2021-02-26T17:37:43","date_gmt":"2021-02-26T22:37:43","guid":{"rendered":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/?p=54356"},"modified":"2021-02-26T17:46:18","modified_gmt":"2021-02-26T22:46:18","slug":"ransomware-virtual-machine-crowdstrike-hypervisor","status":"publish","type":"post","link":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/","title":{"rendered":"Ransomware hackers turn to virtual machine software to boost extortion schemes"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Ransomware gangs that target big corporations for extortion have long designed their code to execute on Microsoft Windows systems because of the popularity of the operating software. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now, though, crooks are increasingly applying that tactic to the \u201chypervisor\u201d computer servers that organizations use to manage virtual machines as a way of maximizing their extortion schemes, security firm <a href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/tag\/crowdstrike\/\">CrowdStrike<\/a> said Friday.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ransomware hackers have <a href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/health-care-ransomware-coronavirus-ryuk\/\">targeted hospitals and schools<\/a> throughout the pandemic, a security challenge that the Biden administration has vowed to address. Alejandro Mayorkas, the newly installed Homeland Security secretary, on Thursday <a href=\"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/dhs-25-million-cybersecurity-grant-funding\/\">called ransomware attacks on U.S. public and private organizations an \u201cepidemic\u201d<\/a> while pledging more government resources to fight the problem. \u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Breaching a hypervisor is an efficient way for the scammers to encrypt all of the virtual machines running on that software system without having to individually infect each machine. The goal is to up the pressure on big organizations to pay out hefty ransoms.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the second half of 2020, two Eastern European criminal groups that CrowdStrike calls Sprite Spider and Carbon Spider began deploying malicious code written for the Linux operating system and designed to affect ESXi, a type of hypervisor. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CrowdStrike did not name the organizations targeted by the malware, but the firm warned that other groups could emulate the activity. The company published <a href=\"https:\/\/www.crowdstrike.com\/blog\/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware\/\">details on the emerging technique in a blog post<\/a>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The emergence of the Linux-focused <a href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/tag\/ransomware\/\">ransomware<\/a> strains comes as organizations are increasingly using virtual machines to consolidate their IT networks. But that concentration of resources on a few servers also risks creating a \u201cvirtual jackpot\u201d for ransomware gangs, as CrowdStrike researchers Eric Loui and Sergei Frankoff put it. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The evolution of the two cybercriminal groups mirrors the broader ransomware ecosystem that now thrives on a <a href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/maze-ransomware-mandiant-lessons-learned\/\">\u201cransomware-as-a-service\u201d<\/a> model that leases hacking tools to maximize profit. Shortly after the coronavirus pandemic took hold and the hospitality sector suffered, Carbon Spider shifted from targeting point-of-sale devices to large organizations as a business tactic, according to CrowdStrike.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cThis development shows that the ransomware actors are continuing to find new targets, when we see more than one adversary evolve in this way, it likely signifies others will follow suit,\u201d said Adam Meyers, CrowdStrike\u2019s vice president of intelligence.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Two Eastern European criminal groups began targeting hypervisors in 2020, according to  CrowdStrike.<\/p>\n","protected":false},"author":207,"featured_media":54364,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":""},"categories":[5974,2],"tags":[3962,1237,443,276,11],"people":[],"special-report":[],"authors":[3237],"class_list":["post-54356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threats","category-financial","tag-security-research","tag-linux","tag-cybercrime","tag-crowdstrike","tag-ransomware","author-sean-lyngaas"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.8 (Yoast SEO v27.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Ransomware hackers turn to virtual machine software to boost extortion schemes | CyberScoop<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware hackers turn to virtual machine software to boost extortion schemes\" \/>\n<meta property=\"og:description\" content=\"Two Eastern European criminal groups began targeting hypervisors in 2020, according to CrowdStrike.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/\" \/>\n<meta property=\"og:site_name\" content=\"CyberScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-02-26T22:37:43+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-02-26T22:46:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2021\/02\/GettyImages-1228506954.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"686\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sean Lyngaas\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@snlyngaas\" \/>\n<meta name=\"twitter:site\" content=\"@CyberScoopNews\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/ransomware-virtual-machine-crowdstrike-hypervisor\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/ransomware-virtual-machine-crowdstrike-hypervisor\\\/\",\"name\":\"Ransomware hackers turn to virtual machine software to boost extortion schemes | CyberScoop\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/ransomware-virtual-machine-crowdstrike-hypervisor\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/ransomware-virtual-machine-crowdstrike-hypervisor\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2021\\\/02\\\/GettyImages-1228506954.jpg\",\"datePublished\":\"2021-02-26T22:37:43+00:00\",\"dateModified\":\"2021-02-26T22:46:18+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/ransomware-virtual-machine-crowdstrike-hypervisor\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/ransomware-virtual-machine-crowdstrike-hypervisor\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/ransomware-virtual-machine-crowdstrike-hypervisor\\\/#primaryimage\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2021\\\/02\\\/GettyImages-1228506954.jpg\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2021\\\/02\\\/GettyImages-1228506954.jpg\",\"width\":1024,\"height\":686,\"caption\":\"Two ransomware groups that CrowdStrike dubs Sprite Spider and Carbon Spider are trying to boost revenue (Photo by Christof STACHE \\\/ AFP) (Photo by CHRISTOF STACHE\\\/AFP via Getty Images).\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/ransomware-virtual-machine-crowdstrike-hypervisor\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransomware hackers turn to virtual machine software to boost extortion schemes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#website\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\",\"name\":\"CyberScoop\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#organization\",\"name\":\"CyberScoop\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2023\\\/01\\\/CyberScoop-Black.png\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2023\\\/01\\\/CyberScoop-Black.png\",\"width\":1545,\"height\":186,\"caption\":\"CyberScoop\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cyberscoop\\\/\",\"https:\\\/\\\/x.com\\\/CyberScoopNews\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/cyberscoop\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCDG2jjHiZ8r97MCVnsaAkXw\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Ransomware hackers turn to virtual machine software to boost extortion schemes | CyberScoop","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware hackers turn to virtual machine software to boost extortion schemes","og_description":"Two Eastern European criminal groups began targeting hypervisors in 2020, according to CrowdStrike.","og_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/","og_site_name":"CyberScoop","article_publisher":"https:\/\/www.facebook.com\/cyberscoop\/","article_published_time":"2021-02-26T22:37:43+00:00","article_modified_time":"2021-02-26T22:46:18+00:00","og_image":[{"width":1024,"height":686,"url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2021\/02\/GettyImages-1228506954.jpg","type":"image\/jpeg"}],"author":"Sean Lyngaas","twitter_card":"summary_large_image","twitter_creator":"@snlyngaas","twitter_site":"@CyberScoopNews","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/","name":"Ransomware hackers turn to virtual machine software to boost extortion schemes | CyberScoop","isPartOf":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#website"},"primaryImageOfPage":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/#primaryimage"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/#primaryimage"},"thumbnailUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2021\/02\/GettyImages-1228506954.jpg","datePublished":"2021-02-26T22:37:43+00:00","dateModified":"2021-02-26T22:46:18+00:00","breadcrumb":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/#primaryimage","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2021\/02\/GettyImages-1228506954.jpg","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2021\/02\/GettyImages-1228506954.jpg","width":1024,"height":686,"caption":"Two ransomware groups that CrowdStrike dubs Sprite Spider and Carbon Spider are trying to boost revenue (Photo by Christof STACHE \/ AFP) (Photo by CHRISTOF STACHE\/AFP via Getty Images)."},{"@type":"BreadcrumbList","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/ransomware-virtual-machine-crowdstrike-hypervisor\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/"},{"@type":"ListItem","position":2,"name":"Ransomware hackers turn to virtual machine software to boost extortion schemes"}]},{"@type":"WebSite","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#website","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/","name":"CyberScoop","description":"","publisher":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#organization","name":"CyberScoop","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#\/schema\/logo\/image\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2023\/01\/CyberScoop-Black.png","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2023\/01\/CyberScoop-Black.png","width":1545,"height":186,"caption":"CyberScoop"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cyberscoop\/","https:\/\/x.com\/CyberScoopNews","https:\/\/www.linkedin.com\/company\/cyberscoop\/","https:\/\/www.youtube.com\/channel\/UCDG2jjHiZ8r97MCVnsaAkXw"]}]}},"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"CyberScoop","distributor_original_site_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop","push-errors":false,"jetpack_featured_media_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2021\/02\/GettyImages-1228506954.jpg","_links":{"self":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/54356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/users\/207"}],"replies":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/comments?post=54356"}],"version-history":[{"count":6,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/54356\/revisions"}],"predecessor-version":[{"id":54367,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/54356\/revisions\/54367"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/media\/54364"}],"wp:attachment":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/media?parent=54356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/categories?post=54356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/tags?post=54356"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/people?post=54356"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/special-report?post=54356"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/authors?post=54356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}