Cheerscrypt
- ID
- S1096
- Type
- Malware
- Platforms
- Windows, ESXi
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
Cheerscrypt is a ransomware that was developed by Cinnamon Tempest and has been used in attacks against ESXi and Windows environments since at least 2022. Cheerscrypt was derived from the leaked Babuk source code and has infrastructure overlaps with deployments of Night Sky ransomware, which was also derived from Babuk.[1][2]
Techniques used (5)
- T1059.012 Hypervisor CLI
- T1083 File and Directory Discovery
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1673 Virtual Machine Discovery