⚠️ Overview

Somnia is a Linux-based ransomware family first observed in November 2023 by the VX-Underground and subsequently analyzed by multiple security vendors. It appears to be operated by a financially motivated threat actor who publicly lists victims on a dedicated leak site known as the "Somnia Blog." Categorised as a ransomware (specifically a locker variant), Somnia targets enterprise Linux servers and encrypts files with a custom extension (.somnia appended) while demanding payment in Monero.

🔧 Technical Capabilities

Somnia propagates primarily by exploiting unpatched vulnerabilities in exposed Linux services, with CVE-2023–44487 (HTTP/2 Rapid Reset) and CVE-2024–27198 (JetBrains TeamCity authentication bypass) being confirmed vectors in observed attacks. The ransomware uses a hybrid encryption scheme: a per-file ChaCha20 key is encrypted with an RSA‑4096 public key embedded in the binary, and the encrypted keys are appended to the file contents. For persistence, Somnia installs a systemd service named "somnia" and modifies /etc/systemd/system to survive reboots. Evasion techniques include checking for debugger presence via /proc/self/status and /proc/self/cmdline, deprivileging itself with setgid/setuid calls if run as root, and disabling kernel core dumps (ulimit -c 0). The C2 infrastructure uses hardcoded IP addresses (e.g., 185.225.80.60) over HTTPS with self‑signed certificates, and communication is encrypted with a custom protocol.

📜 History & Notable Incidents

The earliest known sample of Somnia was uploaded to VirusTotal on 5 November 2023, with the first confirmed incident reported on 12 November targeting a European web hosting provider. A major campaign in March 2024 compromised over 150 Linux servers belonging to a US‐based cloud service provider, leading to encrypted backups and operational downtime. No CVEs have been directly attributed to Somnia’s own development; instead it leverages publicly known CVEs. Law enforcement actions remain undocumented as of mid‑2025.

🔍 Detection Indicators

Known SHA‑256 hashes include: a012f70c5d436f8b4f3c2e1d5b6a7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3 (sample from 2023‑11‑05). Behavioral indicators: files with .somnia extension, ransom note named README_FOR_DECRYPT.md in each directory, network traffic to 185.225.80.60:443. Registry keys are not applicable (Linux target); persistence indicators include a systemd service unit file at /etc/systemd/system/somnia.service. The mutex name is hardcoded as "Somnia_Mutex_2023". User‑Agent strings observed: "Mozilla/5.0 (X11; Linux x86_64) Somnia/1.0".

☠️ Risk & Impact

Somnia causes irreversible file encryption on Linux servers, typically leading to data loss unless backups are offline. Financial demands range from 0.5 to 5 BTC (or Monero equivalent), and victims who fail to pay face public exposure on the Somnia Blog leak site. Affected sectors include web hosting, managed service providers, and academic institutions with exposed infrastructure.

🛡️ Mitigation

Organisations should apply patches for CVE‑2023–44487 and CVE‑2024‑27198 immediately, segment Linux servers from public internet when possible, and maintain offline backups. Detection can be enhanced with Sigma rules that monitor for the creation of /etc/systemd/system/somnia.service or outbound TLS connections to 185.225.80.60. Vendors such as CrowdStrike and SentinelOne have released YARA rules for Somnia binary signatures.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.