Abyss Locker Ransomware Recovery: HelloKitty-Based ESXi Encryptor
Abyss Locker started in March 2023 as a double-extortion operation. Its second version added a Linux encryptor aimed at VMware ESXi, which researchers believe is derived from the HelloKitty ransomware but uses ChaCha encryption; it is not known whether this is a rebrand of HelloKitty or a different group using the code. ransomware.live counts about 90 victim claims.
How Abyss Locker hits ESXi
Reported entry includes brute-forcing weak SSH passwords. On the host, the encryptor uses the ESXi esxcli tool to list the virtual machines and stop them, softly, hard or forcibly, and then encrypts the virtual disk, snapshot and metadata files. Because ESXi does not run third-party malware detection, the encryption often goes unnoticed until every VM is down.
Abyss Locker ransomware data recovery: what we recover
We measure which regions of each encrypted VMDK were overwritten and rebuild the guest file systems, SQL Server and Oracle databases and files from the intact parts. Do not reinstall ESXi or reformat the datastores; copy the encrypted files and contact us for a free assessment. No data, no charge.
Veeam backups, SQL Server or Oracle databases encrypted by Abyss Locker?
Ransomware groups go after the backup repository first. A .vbk or .vib file renamed by the ransomware is often not lost: large backup files are usually only partly encrypted, and the intact blocks can be verified and rebuilt into the virtual disks. The same holds for SQL Server MDF and BAK files and for Oracle datafiles and Data Pump exports: the rows the ransomware did not reach can be read directly. In real cases we rebuilt a 466 GB server disk from a 43 GB Akira-encrypted VBK, and recovered 98.8% of the rows from LockBit-encrypted SQL Server backups.
- Ransomware-encrypted Veeam VBK recovery →
- AS VBK Recovery Studio: free analysis of an encrypted VBK →
- Ransomware-encrypted SQL Server database recovery →
- AS SQL Recovery & Repair Studio: free analysis of an encrypted MDF or BAK →
- Ransomware-encrypted Oracle database recovery →
- NAS and RAID ransomware recovery →
- Ransomware-encrypted VMware VMDK recovery →
Abyss Locker ransomware data recovery: contact us now
We have already solved 656+ ransomware and data recovery cases: encrypted and corrupted SQL Server, Oracle and MySQL databases, Tally, Busy and Marg ERP data, Veeam backups, VMware and Hyper-V virtual machines, RAID and NAS. Send us the details and we tell you what we can recover.
- ✓ Free assessment before you pay anything
- ✓ No data, no charge
- ✓ NDA on request
Email: info [at] asittech.com · Mon–Fri, 9:00–18:00 IST