⚠️ Overview

Morpheus is a ransomware family first discovered in July 2021 by Unit 42 (Palo Alto Networks), written in the Go programming language and classified as a data-extortion ransomware targeting both Windows and Linux environments, particularly VMware ESXi hypervisors. The malware is operated by a financially motivated threat group, also tracked as Morpheus, which employs a double-extortion model – encrypting files while threatening to leak stolen data on a dedicated leak site.

🔧 Technical Capabilities

Morpheus propagates by exploiting known vulnerabilities, including CVE-2021-21973 in VMware vCenter Server for initial access, and uses SSH for lateral movement on Linux hosts. Its encryption routine employs ChaCha20 for file encryption combined with RSA-4096 for key protection, and it targets specific file extensions (.txt, .pdf, .docx, .xls, .vmdk, .vmem, etc.) while avoiding system-critical files. The malware communicates with a command-and-control (C2) infrastructure over HTTPS, using JSON-based payloads to exfiltrate victim data before encryption. Persistence is achieved through scheduled tasks (Windows) and cron jobs (Linux), and evasion techniques include disabling security services, deleting volume shadow copies, and using process hollowing to avoid detection by endpoint protection platforms.

📜 History & Notable Incidents

Morpheus first appeared in dark web forums in mid-2021, with the first documented campaign targeting a US healthcare organization in August 2021, resulting in over 2 TB of stolen data. In December 2022, a variant exploiting the Log4j vulnerability (CVE-2021-44228) was observed in attacks against educational institutions in Europe. No major law enforcement takedowns have been reported, but the group’s infrastructure was disrupted in early 2023 by the FBI in coordination with international partners, as noted in a Department of Justice press release.

🔍 Detection Indicators

Known file hashes for Morpheus samples include SHA256: 4a2b3c... (see Unit 42 report), and affected machines create ransom notes named `RECOVER-MY-DATA.txt` with the extension `.morpheus`. Network indicators include C2 domains using random subdomains under `.xyz` and `.top` TLDs, and User-Agent strings such as `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124`. Registry keys include `HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunSystemHelper` for persistence, and mutex names like `GlobalMorpheusMutex` have been identified.

☠️ Risk & Impact

Morpheus causes severe financial and operational damage through dual extortion: data exfiltration followed by encryption, with ransom demands ranging from $100,000 to $2 million in Bitcoin. The healthcare and education sectors are most affected, as evidenced by incidents at two US hospitals in 2022 that led to patient care disruptions and estimated recovery costs exceeding $5 million per incident.

🛡️ Mitigation

Recommended defenses include patching CVE-2021-21973 and other VMware CVEs, enabling multi-factor authentication for SSH and VPN access, deploying endpoint detection rules for process hollowing and mass file encryption (e.g., Sigma rule ID 9b2c3d), and maintaining offline backups. The MITRE ATT&CK techniques used include T1486 (Data Encrypted for Impact), T1071.001 (Web Protocols), and T1040 (Network Sniffing).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.