Beast/GodDamn Linux Encrypter Executed with ESXi Auto-Shutdown/Unlock Flag

Duo Tech@duotech

•updated Jul 13, 2026•3•0•10

Detects the execution of the 'encrypter-linux-x86' binary on Linux systems, specifically looking for command-line arguments indicative of file encryption activity (-e or --esxi). This binary name is frequently associated with ransomware targeting virtualized environments.