Researchers at Trend Micro have observed a new Linux variant of TargetCompany ransomware built to infect VMware ESXi environments. TargetCompany is a ransomware operation that mostly targets organizations in Taiwan, South Korea, India, and Thailand. TargetCompany (aka Mallox) has been known for attacking databases (MySQL, Oracle, SQL Server) since June 2021. The new Linux variant of the ransomware performs a check to determine whether it is running in a VMWare ESXi environment as well as checking whether it is being run with administrator privileges. The ransomware uses a custom shell script for payload execution and delivery, which is coded to exfiltrate data to two different servers for redundancy. TargetCompany encrypts files that have extensions related to virtual machines and appends them with the extension “.locked”. The ransom note is a text file named “HOW TO DECRYPT.txt” and instructs victims to access a dark web chatroom to receive payment details for the ransom. Once encryption is complete, it deletes itself using the command “fm -f x” to hinder post-exploitation analysis by incident responders. Trend Micro has provided the Indicators of Compromise (IoCs) associated with the ransomware in their blog post of their analysis. CTIX analysts will continue to report on new and emerging strains of malware and associated campaigns.