Daixin Team ransomware

Daixin Team is an extortion crew, active since at least mid-2022, that encrypts virtual machine files on VMware ESXi hosts. Its locker walks /vmfs/volumes/ and hits disk, memory, swap, snapshot and configuration files ( .vmdk, .vmem, .vswp, .vmsd, .vmx, .vmsn ), leaving a note in the same datastore path. The note opens with a welcome to "the ransomware world", says documents were taken, supplies a Tor address and personal PIN, gives five days before publication and is signed with the group name, in one published sample misspelled as "Daxin". The group focuses on healthcare and public health organisations, the subject of joint FBI, CISA and HHS advisory AA22-294A. Entry has come through VPN servers, either by exploiting an unpatched appliance or by logging in with phished credentials where MFA was absent; the actors then pivot over RDP and SSH, reset ESXi passwords through vCenter and deploy the payload, which third-party analysis ties to leaked Babuk source code. Patient and personal data has been pulled out with Rclone to a private server and via Ngrok tunnels.

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.

Data exfiltration risk: Confirmed — The FBI/CISA/HHS advisory reports confirmed theft of PII and patient health information using Rclone to a private server and Ngrok tunnels.

Systems typically targeted: VMware ESXi hosts and vCenter, with Windows systems used for lateral movement

Do this first: Reset vCenter and ESXi root credentials, disable VPN accounts without MFA and look for Rclone or Ngrok activity before powering virtual machines back on.