---
title: Rust-based Ransomware can hit anywhere including Windows, Linux and VMware ESXi - Codenotary
description: MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®
image: https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg
---

**$ protect --distro linux --machines 25 --free**

[Start now](https://apps.codenotary.com/linux)

[![cn-logo-black-nobg](https://codenotary.com/hubfs/cn-logo-black-nobg.svg)](https://codenotary.com/)

- Product
  
  #### [![AgentMon Start](https://codenotary.com/hubfs/chub_backup/AgentMon%20Start.svg) **AgentMon Start** See what your AI agents are doing on your machine. TRY NOW →](https://codenotary.com/agentmon-start)
  
  #### [![AgentMon for Enterprise](https://codenotary.com/hubfs/AgentMon%20for%20Enterprise.svg) **AgentMon** Currently monitors more \> 7 million agent interactions/day. TRY NOW →](https://codenotary.com/agentmon)
  
  #### [![AgentX](https://codenotary.com/hubfs/AgentX.svg) **AgentX** Agentic network control middleware. TRY NOW →](https://codenotary.com/agent-network-control)
  
  #### [![Autonomous Security](https://codenotary.com/hubfs/Autonomous%20Security.svg) **Autonomous Security** AI Agents keep your servers secure. TRY NOW →](https://codenotary.com/trust)
- Use Cases
  
  #### [**AI Agent Risk Monitoring** Continuous oversight of autonomous agents across every environment.](https://codenotary.com/use-cases#risk)
  
  #### [**Autonomous Security Operations** Self-healing defenses that detect, contain, and remediate threats.](https://codenotary.com/use-cases#agentops)
  
  #### [**AI Coding Governance & Performance Monitoring** AI-generated code reviewed, tracked, and held to quality standards.](https://codenotary.com/use-cases#performance)
  
  #### [**AI Tool Cost & Usage Optimization** Spend and consumption optimized across every AI service in use.](https://codenotary.com/use-cases#cost)
  
  #### [**AI Tool Security & Policy Enforcement** Approved AI usage enforced with guardrails and policy controls.](https://codenotary.com/use-cases#security#security)
  
  #### [**Shadow AI Governance** Unsanctioned AI tools discovered, surfaced, and brought under control.](https://codenotary.com/use-cases#shadowit)
- [Blog](https://codenotary.com/blog)
- [Press](https://codenotary.com/press)
- Resources
  
  #### [**Integrations** Connect with your favorite tools and platforms. LEARN MORE →](https://codenotary.com/integrations)
  
  #### [**Support** Get help from our dedicated support team. GET HELP →](https://support.codenotary.com)
  
  #### [**Success Stories** Read how customers achieve their goals. READ MORE →](https://codenotary.com/success)
  
  #### [**Learn** Access documentation and learning resources. EXPLORE →](https://codenotary.com/learn)

[Login](https://apps.codenotary.com/auth/login)

[All posts](https://codenotary.com/blog/all)

 Aug 02, 2022

# Rust-based Ransomware can hit anywhere including Windows, Linux and VMware ESXi

 By  [Dennis](https://codenotary.com/blog/author/dennis)  ·   2 minute read

While it’s great for application developers to write applications in a language that runs seamlessly on many different operating systems, there is a downside to the application’s intention. Ransomware has damaged many companies, causing downtime, money, and sleepless nights. Looking into some statistics you can find damage predictions of [**$265 billion by 2031**](https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-250-billion-usd-by-2031).

Writing Ransomware software in a development language like Rust opens new ways of attack as it can be easily compiled to work on many different operating systems including hypervisors like VMware ESXi.

![fig6-3](https://codenotary.com/hubfs/Imported_Blog_Media/fig6-3-1.png)

 source: https://www.uptycs.com/blog/black-basta-ransomware-goes-cross-platform-now-targets-esxi-systems

There is a syndicate called Black Basta that provides ransomware-as-a-service (Raas) that became prominent very quickly by amassing 50 victims within 2 months and is known for cross-platform ransomware development. And that cross-platform ransomware is already becoming a trend.

![](https://codenotary.com/hubfs/Imported_Blog_Media/ransomware-1.jpg)

 source: https://thehackernews.com/2022/06/cybersecurity-experts-warn-of-emerging.html

Some researchers warn that “Ransomware remains a big problem for today’s society – as soon as some families come off the stage, others take their place.” [**It is becoming the biggest global cyber treat**](https://www.zdnet.com/article/ransomware-attacks-are-the-biggest-global-cyber-threat-and-still-evolving-warns-cybersecurity-chief/).

To avoid being the next victim on the list many countermeasures are required and will help guard against many new problems that will arise over the coming months and year. Here are some general guidelines.

## Know your software

An important countermeasure is to have a actively maintained catalog of the software that is running in your data center, computer, and edge device. Having SBOMs (Software Bill of Materials) and active search capabilities over dynamic SBOMs is a great help. Especially for cross-platform ransomware  which typically is delivered as a single binary and the unique checksum disclosed by ransomware researcher or as part of security advisories.

As an example, one version of the ransomware binary hash (or checksum) that can affect Linux and VMware ESXi is **0d6c3de5aebbbe85939d7588150edf7b7bdc712fceb6a83d79e65b6f79bfc2ef**.

Having a software platform like Codenotary Trustcenter enables you to simply search for this checksum or any other you are aware of. That way you can find out if you already have that component in your environment or get alerts the moment it is detected somewhere. Of course you can also pro-actively untrust these hashes when you read about it, so your build and/or deployment process don’t even continue when such a checksum appears.

## Be aware

The chances of becoming a victim of a ransomware attack are increasing every day. The bad actors are very creative with email campaigns, social engineering or [**even fake job offers**](https://www.theblock.co/post/156038/how-a-fake-job-offer-took-down-the-worlds-most-popular-crypto-game). Having Web Application Firewalls (WAF) in place is very important to protect against exposed software and database vulnerabilities. Antivirus software and vulnerability scanner to detect known threats. Backup and Archiving solutions need to be in place as well – the last resort.

But awareness of every team member in your company or organization is of huge importance.

- Double-check if the tone of the email isn’t weird coming from someone you know
- [**The attachment looks weird or are uncommon, i. e. xls instead of pdf**](https://thehackernews.com/2022/01/emotet-now-using-unconventional-ip.html)
- Why does someone reach out to update my Google business address
- Why do I get a credit note from a company I didn’t order anything for a long time

There is much more to it, but in general – if something looks fishy, don’t open it.

## Software Updates

Updating software and operating systems is always a bit risky, but not updating it is even riskier today. If there is an exploit that can be used because of an older version of a library or application, you open the doors for malicious code including ransomware. Log4j is still a very present example and will take a long time before the exploit will stop and the updates are in place.

## Permissions, Permissions, Permissions

Many applications can’t do much or limit damage when the permissions are restrictive. The [**principle of**](https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/least-privilege) least privilege is key and very important. Don’t open applications with elevated permissions you don’t know and are scanned and approved. Don’t log in as root or use sudo to run applications.

[![Share on twitter](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/twitter-color.png?width=35&height=35&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://codenotary.com/blog/rust-based-ransomware-can-hit-anywhere-including-windows-linux-and-vmware-esxi&utm_medium=social&utm_source=twitter&url=https://codenotary.com/blog/rust-based-ransomware-can-hit-anywhere-including-windows-linux-and-vmware-esxi&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/facebook-color.png?width=35&height=35&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://codenotary.com/blog/rust-based-ransomware-can-hit-anywhere-including-windows-linux-and-vmware-esxi&utm_medium=social&utm_source=facebook) [![Share on linkedin](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/linkedin-color.png?width=35&height=35&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://codenotary.com/blog/rust-based-ransomware-can-hit-anywhere-including-windows-linux-and-vmware-esxi&utm_medium=social&utm_source=linkedin) [![Share on pinterest](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/pinterest.jpg?width=35&height=35&name=pinterest.jpg)](http://pinterest.com/pin/create/button/?url=https://codenotary.com/blog/rust-based-ransomware-can-hit-anywhere-including-windows-linux-and-vmware-esxi&utm_medium=social&utm_source=pinterest&media=)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Dennis",
    "url" : "https://codenotary.com/blog/author/dennis"
  },
  "dateModified" : "2023-02-14T21:18:05.968Z",
  "datePublished" : "2022-08-02T07:15:05.000Z",
  "headline" : "Rust-based Ransomware can hit anywhere including Windows, Linux and VMware ESXi - Codenotary",
  "image" : [ "https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://codenotary.com/blog/rust-based-ransomware-can-hit-anywhere-including-windows-linux-and-vmware-esxi",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://codenotary.com/hubfs/logo-light.svg"
    },
    "name" : "Codenotary, Inc."
  }
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Article",
  "author" : {
    "@type" : "Person",
    "name" : [ "Dennis" ],
    "url" : "https://codenotary.com/blog/author/dennis"
  },
  "datePublished" : "2022-08-02T07:15:05+0000",
  "description" : "MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®",
  "headline" : "Rust-based Ransomware can hit anywhere including Windows, Linux and VMware ESXi",
  "image" : "https://23873599.fs1.hubspotusercontent-na1.net/hubfs/23873599/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://cdn2.hubspot.net/hubfs/23873599/logo-light.svg"
    },
    "name" : ""
  },
  "url" : "https://codenotary.com/blog/rust-based-ransomware-can-hit-anywhere-including-windows-linux-and-vmware-esxi"
}
```