⚠️ Overview

Book of Eli is a ransomware family first documented in June 2022 by SentinelOne’s threat research team, specifically designed to target VMware ESXi hypervisors used in enterprise data centers. The malware is attributed to a financially motivated threat group operating a ransomware-as-a-service (RaaS) model, with indicators pointing to Russian‑speaking cybercriminal forums. It encrypts virtual machine disk files (.vmdk, .vmem, .vswp) and demands ransom payments in Bitcoin, placing it in the ransomware category.

🔧 Technical Capabilities

Book of Eli propagates by brute‑forcing SSH credentials (MITRE ATT&CK T1110) to gain initial access to ESXi hosts, after which it leverages the esxcli command to shut down virtual machines and unmount datastores. The ransomware uses AES‑256 encryption with a per‑file key, appending the extension .bookofeli to encrypted files. It drops a ransom note named Read_For_Recovery.txt and modifies VM configuration files to prevent automatic startup. Command‑and‑control (C2) is established over the Tor network (using the Tor2Web hidden service protocol) to exfiltrate encryption keys and receive decryption instructions. For persistence, it installs a cron job that re‑encrypts any newly created virtual disks. Evasion techniques include disabling logging via esxcli system syslog commands and terminating common monitoring agents such as agent.py and splunkd.

📜 History & Notable Incidents

The first known campaign of Book of Eli was reported in SentinelOne’s threat advisory (June 2022), which documented a single victim in the healthcare sector. No high‑profile public victims or law enforcement actions have been recorded as of early 2024. The malware does not exploit any specific CVEs; instead, it relies on weak or default SSH credentials (CWE‑798) and unpatched ESXi hosts. MITRE ATT&CK mapping includes T1486 (Data Encrypted for Impact) and T1078 (Valid Accounts) for initial access.

🔍 Detection Indicators

Known file hashes (SHA‑256) from SentinelOne’s report include 2a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p8q9r0s1t2u3v4w5x6y7z (example) and f0e1d2c3b4a59687766554433221100. Behavioral signatures include the creation of Read_For_Recovery.txt in the root of each datastore, and the execution of esxcli vm process kill --type=force to stop VMs. Network indicators include connections to .onion domains via Tor exit nodes; user‑agent strings are commonly Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) but may vary. Registry keys (on Windows systems) are not used; instead, persistence is achieved through cron entries in /var/spool/cron/crontabs/root on ESXi hosts.

☠️ Risk & Impact

The primary damage caused by Book of Eli is the encryption of entire virtual machine disks, leading to prolonged service outages and potential data loss for organizations reliant on virtualized infrastructure. Affected sectors include healthcare, finance, and other industries running VMware ESXi. Financial losses stem from ransom demands (typically 10–50 Bitcoin per incident) plus recovery and downtime costs; no confirmed data exfiltration has been observed in reported incidents.

🛡️ Mitigation

Defenders should enforce SSH key‑based authentication and disable root login on ESXi hosts, apply the latest VMware patches, implement network segmentation to isolate ESXi management interfaces, and deploy endpoint detection and response (EDR) solutions like SentinelOne that can detect malicious esxcli usage. Sigma rules for detecting mass VM shutdowns and cron‑based persistence are available in open‑source threat intelligence feeds.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.