SEXi Ransomware Rebrands as 'APT Inc.,' Keeps Old Methods
The cybercrime group demands ransoms of varying degrees, from thousands to even millions of dollars — in some cases, 2 bitcoin per encrypted customer.
![People holding scissors to a red ribbon People holding scissors to a red ribbon](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt8597a13d2bb03c12/66957f26a24c0d771f89e5dc/opening_ribbon(1800)_ronstik_alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
SEXi ransomware group, a cybercrime group that has targeted a variety of organizations in attacks that started in February of this year, has been operating under the name of APT Inc. since June.
The group uses a leaked Babuk encryptor to target VMware ESXi servers, and a leaked LockBit 3 encryptor to target Windows servers.
Now, having rebranded, the group continues to use its original methods of encryption as it wreaks havoc on new victims, requesting ransom demands that vary from thousands to millions dollars.
Some victims have publicly shared their experiences with the APT Inc. attacks, such are sharing ransom notes like the following:
"You got hacked! We are APT INC; Go to https://getsession[dot]org/; download & install; then add 05c5dbb3e0f6c173dd4ca479587dbeccc1365998ff9042581cd294566645ec7912 to your contacts and send us a message with this codename - - - > GARAKLY; You gave 1 week to pay, then your decryptor will be deleted," stated one ransom note. "The longer you wait the more money you will have to pay. Don't involve 3rd parties — they can't help you, they will charge you money for nothing, moreover, we always tell them to fuck off; Are you the admin? Talk to your boss right now !!!"
Currently, there are no known weaknesses to Babuk and LockBit 3 encryptors, and there is no free method to recovering the files.
About the Author
You May Also Like
Your guide to the great SIEM migration
August 21, 2024How to Find and Fix Application Vulnerabilities
August 22, 2024Securing Your Cloud Assets
August 27, 2024Determining Exposure and Risk In The Event of a Breach
August 28, 2024Developing a Cyber Risk Assessment for the C-Suite
August 29, 2024
Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024