Kraken Ransomware Targets Windows, Linux, and VMware ESXi in Enterprise Environments

According to Talos, Kraken is a cross‑platform ransomware threat that has emerged from the HelloKitty ecosystem and was observed in August 2025 conducting big‑game hunting and double‑extortion attacks against enterprise environments worldwide. The group targets Windows, Linux and VMware ESXi with distinct encryptors for each platform, enabling extensive damage across traditional servers and virtualised infrastructure.

Its infection chain begins with exploitation of SMB vulnerabilities on internet‑exposed servers, followed by credential dumping and re‑entry via RDP connections, with Cloudflared used for persistence and SSHFS for data exfiltration before encryption. Kraken employs a double extortion approach, threatening public disclosure on its data leak site and has reportedly demanded circa 1 million USD in Bitcoin, with assurances of decryption and non‑disclosure on payment.

Notable technical capabilities include encryption benchmarking, WoW64 redirection manipulation and anti‑analysis techniques, while the ESXi variant encrypts by terminating running VMs and appends the .zpsc extension to files, with RSA‑4096 and ChaCha20 used for multi‑threaded encryption.

Victims span multiple geographies—United States, United Kingdom, Canada, Denmark, Panama and Kuwait—reflecting its broadly indiscriminate targeting alongside recommendations for SMB segmentation, isolated backups, multi‑factor authentication and behavioural detection.