Gwisinlocker: New Ransomware Targets Windows And Linux Esxi Servers

By Editor Last updated Mrz 4, 2025

GwisinLocker is a recently discovered ransomware that specifically targets Linux-based systems, with a particular focus on VMware ESXi servers and virtual machines. This ransomware has been identified by ReversingLabs cybersecurity analysts and is believed to be associated with a relatively unknown threat actor. Notably, GwisinLocker has been observed targeting South Korean companies, particularly in the pharmaceutical industry, during Korean public holidays. This suggests a comprehensive understanding of cultural and business practices in the country. GwisinLocker encrypts devices using an MSI file, utilizing an embedded DLL as the ransomware encryptor. To avoid detection, it can be configured to operate in safe mode and inject the DLL into Windows processes. The primary target of this ransomware is ESXi virtual machines, and it contains command-line arguments specifically designed for VM encryption. Ransom notes explicitly discourage victims from contacting law enforcement agencies and instruct them to utilize the Tor browser for communication and payment. For reliable information on GwisinLocker and related news stories, Cyber Security News serves as a credible source for cybersecurity updates.

Quickjump

Key Takeaways

GwisinLocker is a newly discovered ransomware that specifically targets Linux-based systems, particularly VMware ESXi servers and VMs.
The ransomware is believed to be produced by a little-known threat actor and has been found to target South Korean companies, specifically in industries such as pharmaceuticals.
GwisinLocker uses an MSI file and an embedded DLL as the encryptor, and it can be configured to run in safe mode to evade detection.
The ransom notes left by GwisinLocker instruct victims to use the Tor browser for anonymity and provide login and payment instructions to restore their encrypted files.

Overview of GwisinLocker

GwisinLocker is a newly discovered ransomware that specifically targets Windows and Linux ESXi servers, using an MSI file and an embedded DLL as its encryptor, with a focus on encrypting ESXi virtual machines. To detect GwisinLocker ransomware, it is crucial to employ effective detection methods such as network traffic analysis, behavior-based analysis, and signature-based detection. Additionally, to protect Linux-based systems from GwisinLocker attacks, several steps can be taken. These include regularly updating the operating system and software, implementing strong password policies, restricting unnecessary network services, using firewalls and intrusion detection systems, and conducting regular backups of critical data. Furthermore, user education and awareness about phishing emails and suspicious downloads can also play a vital role in preventing GwisinLocker infections.

Attack on South Korean Companies

The cyberattacks on South Korean companies demonstrate a deep understanding of cultural and business practices in the country, as indicated by the timing of the attacks during Korean public holidays and the appearance of information on Gwisin and its activities in South Korean media outlets.

The attackers‘ thorough knowledge of cultural practices suggests that they are well-versed in the nuances of South Korean society, allowing them to maximize the impact of their attacks.
The targeting of the pharmaceutical industry specifically indicates a potential motive related to intellectual property theft or disruption of critical services.
The attacks during public holidays may have been chosen to exploit reduced staffing and security measures during these periods.
The appearance of information on Gwisin and its activities in South Korean media outlets suggests a deliberate attempt to instill fear and raise awareness among the local population.
The cultural implications of these attacks extend beyond the immediate financial and operational impact, potentially damaging trust and confidence in South Korean companies and their ability to protect sensitive data and infrastructure.

Encryption Process

The encryption process employed by this ransomware involves the use of an embedded DLL within an MSI file, which is injected into Windows processes to avoid detection, and can even be configured to run in safe mode if necessary. The DLL serves as the ransomware encryptor and is designed to effectively encrypt the targeted devices. It would be interesting to analyze the effectiveness of this embedded DLL as a ransomware encryptor and assess its ability to bypass security measures. Additionally, discussions around strategies and tools to detect and prevent DLL injection in Windows processes could provide valuable insights into strengthening cybersecurity defenses against such attacks. These discussions would be particularly relevant for individuals and organizations seeking mastery in protecting their systems from ransomware threats.

Focus on ESXi Virtual Machines

Emphasizing its preference for targeting ESXi virtual machines, the GwisinLocker ransomware employs customized encryptors for each specific operating system it targets. This indicates a level of sophistication and adaptability in its approach. However, the impact on virtual machine performance is a significant concern when dealing with ransomware attacks. Encrypting large amounts of data can cause a noticeable degradation in the performance of ESXi virtual machines, affecting the overall efficiency of the system. To protect ESXi virtual machines from ransomware attacks like GwisinLocker, it is essential to implement a multi-layered security approach. This includes regularly updating and patching the system, implementing strong access controls, conducting regular backups, and educating users about phishing and social engineering tactics. Additionally, deploying advanced threat detection and prevention solutions can help identify and mitigate ransomware attacks before they can cause significant damage to the virtual machines.

Ransom Note Instructions

Regarding the ransom note instructions, victims of the GwisinLocker ransomware are directed to use the Tor browser to access an onion address, where they must log in and make a payment to restore their encrypted files. This method of communication and payment allows the operators of the ransomware to maintain anonymity and avoid detection by law enforcement agencies. The use of Tor browser and onion addresses ensures a secure and encrypted connection, making it harder for authorities to trace the identity of the attackers. To prevent and mitigate ransomware attacks on Linux-based systems, businesses should implement a multi-layered security approach. This includes regularly updating software and operating systems, using strong and unique passwords, implementing firewalls and intrusion detection systems, conducting regular backups, and educating employees on cybersecurity best practices. Additionally, implementing security solutions that can detect and block ransomware attacks can also be beneficial in safeguarding against such threats.

Implementing a multi-layered security approach
Regularly updating software and operating systems
Using strong and unique passwords
Implementing firewalls and intrusion detection systems
Conducting regular backups
Educating employees on cybersecurity best practices
Detecting and blocking ransomware attacks using security solutions
Impact of ransomware attacks on South Korean businesses
Strategies to prevent and mitigate ransomware attacks on Linux-based systems.

Frequently Asked Questions

How does GwisinLocker specifically target Linux-based systems?

GwisinLocker specifically targets Linux-based systems by exploiting vulnerabilities in the Linux operating system. It utilizes techniques such as injecting DLLs into Windows processes, running in safe mode, and using a customized encryptor for Linux virtual machines to encrypt files on ESXi servers.

What is the encryption process used by GwisinLocker?

The GwisinLocker ransomware employs an encryption process that involves using an MSI file and an embedded DLL as the encryptor. It injects the DLL into Windows processes to evade detection and can be configured to run in safe mode. This encryption process has significant implications for data security.

Are there any specific industries or sectors targeted by GwisinLocker in South Korea?

GwisinLocker targets specific industries in South Korea, including pharmaceuticals, with a thorough understanding of cultural and business practices. The impact on these sectors is significant, as the ransomware encrypts files and demands payment for their restoration, potentially disrupting operations and causing financial losses.

How does GwisinLocker evade detection and hide its presence on Windows systems?

Ransomware often evades detection on Windows systems by utilizing techniques such as obfuscation, encryption, and fileless malware. Common vulnerabilities in Windows systems that make them susceptible to ransomware attacks include unpatched software, weak passwords, and lack of security measures.

What social media platforms can be used to follow Cyber Security News and stay updated on cybersecurity news?

Users can follow Cyber Security News on social media platforms such as Linkedin, Twitter, and Facebook to stay updated on cybersecurity news. It is important to practice best practices for protecting personal information and to be cautious of phishing attacks on social media.