Malware.View on attack.mitre.org
Cheerscrypt is a ransomware that was developed by Cinnamon Tempest and has been used in attacks against ESXi and Windows environments since at least 2022. Cheerscrypt was derived from the leaked Babuk source code and has infrastructure overlaps with deployments of Night Sky ransomware, which was also derived from Babuk.
| Technique | Procedure example |
|---|---|
| T1059.012 Hypervisor CLI |
Cheerscrypt has leveraged `esxcli` in order to terminate running virtual machines. |
| T1083 File and Directory Discovery |
Cheerscrypt can search for log and VMware-related files with .log, .vmdk, .vmem, .vswp, and .vmsn extensions. |
| T1486 Data Encrypted for Impact |
Cheerscrypt can encrypt data on victim machines using a Sosemanuk stream cipher with an Elliptic-curve Diffie–Hellman (ECDH) generated key. |
| T1489 Service Stop |
Cheerscrypt has the ability to terminate VM processes on compromised hosts through execution of `esxcli vm process kill`. |
| T1673 Virtual Machine Discovery |
Cheerscrypt has leveraged `esxcli vm process list` in order to gather a list of running virtual machines to terminate them. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
