Cheerscrypt

Cheerscrypt is a Linux-based ransomware family that targets VMware ESXi hypervisors. First observed in 2022, it is derived from the leaked Babuk source code, with especially strong similarities to Babuk’s ESXi-focused encryptor, but includes operator-specific modifications. It has been used in attacks against ESXi environments, where compromising a single hypervisor can disrupt many hosted virtual machines and associated enterprise services at once.

Cheerscrypt is designed to encrypt VMware-related data on ESXi systems, including virtual disk, memory, snapshot, swap, and log files. Before encryption, it issues ESXi management commands to forcibly terminate running virtual machine processes so that locked VM files can be accessed and encrypted successfully. It requires a target path as input, processes files within that scope, renames encrypted files with a dedicated extension, and drops a ransom note in affected directories. Console output may be displayed at the end of execution to summarize the encryption routine.

The malware uses the Sosemanuk stream cipher for file encryption, with per-file keys derived through elliptic-curve Diffie-Hellman. It generates ephemeral key material locally using Linux randomness sources and combines that material with an embedded public key controlled by the operator, enabling only the threat actor to recover the corresponding decryption secret. This design means decryption depends on access to the attacker-held private key.

Cheerscrypt has been associated with double-extortion ransomware operations, combining file encryption with additional coercive pressure on victims. Its focus on ESXi infrastructure makes it particularly relevant to enterprise environments that rely on server virtualization and centralized virtual machine hosting.