BlackLock Ransomware Targets Windows, Linux, and VMware ESXi Systems

BlackLock, a rebranded ransomware group formerly known as El Dorado, has emerged as a cross‑platform threat, with analysis showing it can target Windows, Linux and VMware ESXi systems using a single Go‑written binary. According to AhnLab Security Intelligence Center (ASEC), the ransomware employs Go’s standard libraries to simplify development and to operate stably across environments, including a flag for ESXi that remains unimplemented in the samples examined.

Encryption uses the ChaCha20 stream cipher, generating a random 32‑byte FileKey and a 24‑byte nonce for each file, with metadata encrypted via an Elliptic Curve Diffie–Hellman key exchange to guard the FileKey from unauthorised access. A covert backup deletion routine targets Volume Shadow Copy Service snapshots and the Recycle Bin, and victims see files renamed with random extensions accompanied by a ransom note titled HOW_RETURN_YOUR_DATA.TXT.

The campaign and its modus operandi underscore the importance of patch management, offline backups and monitoring of remote code execution and unusual process activity, as organisations running Windows, Linux or VMware ESXi are urged to bolster their defenses and incident response plans. 22 September 2025