New cross-platform ‘Luna’ ransomware only offered to Russian affiliates

A new cross-platform ransomware named Luna can encrypt files on Windows, Linux and ESXi, but its developers only offer it to Russian-speaking affiliates.

The ransomware is fairly simple, according to Kaspersky, whose researchers analyzed the malware, but it uses an encryption scheme not typically used by ransomware – a combination of X25519 and AES.

Luna is developed in Rust, which makes it easy to port to different platforms and can also help evade static analysis.

“The Linux and ESXi samples are compiled using the same source code with minor changes from the Windows version. For example, if the Linux samples are run without command line arguments, they will not run. Instead, they will show available arguments that can be used. The rest of the code has no significant changes compared to the Windows version,” Kaspersky researchers explained in a blog post.

While many ransomware developers are willing to allow people around the world to use their creation for profit, cybercrime forum posts advertising Luna indicate that the malware is only available to Russian-speaking affiliates. Based on this and errors in the English ransom note, researchers assume that Luna was developed by Russian speakers.

After Russia launched its invasion of Ukraine, several Russian cybercriminal groups began targeting organizations located in countries that oppose Russian actions, and some groups even openly expressed support for their government. . It is not surprising that a Russian group only wants to work with local cybercriminals.

Additionally, it is becoming increasingly common for ransomware to target ESXi servers. In May, Trend Micro reported seeing Cheerscrypt, a Linux-based ransomware apparently based on leaked Babuk source code.

Black Basta ransomware, which emerged earlier this year and has been linked to the Conti gang, has also targeted ESXi virtual machine images, as well as Linux systems. The recently emerged RedAlert ransomware also targeted ESXi servers.

Related: It Doesn’t Pay to Pay: Study Finds 80% of Ransomware Victims Reattacked

Related: Organizations Beware of New Lilith, RedAlert, 0mega Ransomware

Related: Black Basta Ransomware Becomes a Major Threat in Two Months

Edouard Kovacs (@EduardKovacs) is a SecurityWeek Contributing Editor. He worked as a high school computer teacher for two years before starting a career in journalism as a security reporter for Softpedia. Eduard holds a bachelor’s degree in industrial computing and a master’s degree in computer techniques applied to electrical engineering.

Previous columns by Eduard Kovacs:
Key words: