Eclipse Ransomware Launches RaaS, Targets Windows, Linux, ESXi

Key Takeaways

• A new Ransomware-as-a-Service (RaaS) called Eclipse Ransomware has emerged, actively recruiting affiliates on underground forums.
• The platform is designed for multi-platform attacks, targeting Windows, Linux servers, NAS devices, VMware ESXi, and Nutanix virtualized environments.
• Eclipse Ransomware leverages a dual-codebase (Rust for Windows, C++ for others) and features advanced capabilities like Hyper-V VM encryption and Veeam backup disruption.
• Operators employ double extortion tactics and offer an attractive revenue split to affiliates, requiring a $300 entry fee and a minimum $70,000 target payout.

A new Ransomware-as-a-Service (RaaS) operation, dubbed Eclipse Ransomware, is currently being promoted on cybercrime forums by a threat actor operating under the alias EclipseSupport. This new venture aims to recruit affiliates for widespread attacks against diverse enterprise systems.

The group claims its platform can compromise a broad array of organizational infrastructure, encompassing Windows and Linux servers, Network Attached Storage (NAS) appliances, VMware ESXi hypervisors, and Nutanix virtualized environments.

Eclipse Ransomware distinguishes itself by adopting a multi-platform design from its inception, moving beyond the limitations of single-operating-system malware. This strategic development reflects a growing trend among sophisticated RaaS models to maximize impact across varied IT infrastructures.

Technical Specifications and Attack Capabilities

The Windows payload for Eclipse Ransomware is engineered in Rust, a programming language valued for its memory safety, performance, and resistance to common evasion techniques. Conversely, the variants designed for Linux, NAS devices, ESXi, and Nutanix environments are developed using C++. This dual-codebase strategy enables the operators to effectively target hybrid enterprise setups, virtualized cloud workloads, and on-premises data centers with a unified RaaS offering.

The malware operators assert that Eclipse Ransomware employs ChaCha20 symmetric encryption, combined with Kyber-based post-quantum cryptographic key exchange mechanisms for robust security. Affiliates are provided with customizable encryption modes, allowing them to balance the speed of execution against stealth, ensuring that file encryption completes before local security tools can intervene.

As observed by DarkWebInformer, the platform incorporates specific routines to encrypt Hyper-V virtual machines and disable Veeam backup infrastructure. These tactics are considered high-value targets, as neutralizing backup repositories and hypervisor stores is a critical step in preventing organizations from performing clean system restores and forcing ransom payments.

For Windows domain environments, the platform reportedly includes automated features designed for:

• Automated Lateral Movement: Facilitating propagation across Active Directory domains.
• Defense Evasion: Disabling endpoint security agents and detection tools.
• Process Termination: Shutting down database services, backup agents, and open file handles before initiating encryption.

The capability to target hypervisors allows threat actors to launch high-impact VMware ESXi attacks, potentially crippling hundreds of virtual servers simultaneously within an organization.

RaaS Ecosystem and Affiliate Program

Eclipse Ransomware operates as a comprehensive, managed affiliate ecosystem. The administrative web panel offers centralized campaign controls, multi-user team access, automated payment validation, real-time activity logging, and an integrated LiveChat portal for direct victim ransom negotiations.

The developers employ double extortion tactics, threatening to publish stolen corporate data on dedicated leak sites if victims refuse to pay the demanded decryption ransom. The platform’s management features are extensive:

• Payment Options: Separate Bitcoin (BTC) and Monero (XMR) wallets are generated for each target.
• Anonymity Layer: Dedicated Tor .onion negotiation addresses are created for every victim.
• Data Extortion: Direct leak-site publishing options are integrated into the affiliate panel.
• Future Modules: Planned features include automated cloud/tape backup targeting, data exfiltration, and builds for FreeBSD/OpenBSD.

To attract seasoned cybercriminals, EclipseSupport is offering an introductory 90/10 revenue split in favor of the affiliate for their initial 10 successful extortion cases. Following this, the split adjusts to a standard 80/20 ratio. Prospective affiliates must pay a $300 entry fee, which the operators claim is fully refundable upon the affiliate’s first successful ransom payout. Additionally, affiliates are required to target organizations with an expected payout threshold of at least $70,000 and are strictly prohibited from submitting ransomware samples to public multi-scanner portals like VirusTotal.

While the claims made by EclipseSupport regarding successful intrusions remain unverified, security teams are strongly advised to proactively strengthen their enterprise networks against such threats.

What You Should Do

• Protect Virtualization Layers: Implement strict network segmentation for ESXi and Hyper-V management interfaces and enforce multi-factor authentication (MFA).
• Harden Backup Systems: Ensure Veeam and other enterprise backup solutions utilize immutable storage, out-of-band credentials, and isolated network paths.
• Audit Active Directory: Enforce least-privilege policies to prevent unauthorized lateral movement and script execution across Windows domains.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.