Cheers

Cheers is a new ransomware group came into the spotlight by targeting vulnerable VMWare ESXi servers, which has been a recent focus of extortionists. A VMWare ESXi is a virtualization platform widely used in enterprise settings worldwide, so encrypting them typically causes severe disruption to a business’s operations. Once compromised, the threat actors launch the encryptor, which will automatically enumerate the running virtual machines and shut them down using an esxcli command. Each encrypted file will be left with a “.Cheers” extension appended to the filename. In the ransom note left on the victim’s screens, the group gives victims three days to contact them. If no contact is made, the group will publicly release data exfiltrated.