Abyss
A double extortion ransomware operation, also called Abyss Locker, built on HelloKitty source code according to Fortinet. It is reported to enter through unpatched edge devices and SSH, then encrypt Windows, NAS and VMware ESXi systems.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Fortinet says Abyss Locker is based on HelloKitty source code and that the threat actor steals data before encrypting it. It describes a Linux variant that targets VMware ESXi, shutting down virtual machines before encrypting.2
Hive Pro, drawing on research from Sygnia and others, reports entry through unpatched VPN appliances, notably SonicWall, and reverse SSH tunnels from ESXi hosts. Network-attached storage is named as a key target.3
SOCRadar lists the UK among affected countries, without UK-specific detail.1
Targeting of backups, NAS and ESXi suggests the aim is to remove recovery options. We would isolate those systems and treat them as high priority.
How It Attacks
Based on Hive Pro's advisory and Cyber Press's summary of Sygnia's research.3,5 We could not open Sygnia's report directly.
- 1
Get In
Exploits unpatched network devices such as VPN appliances, or weak SSH.
- 2
Tunnel and Spread
Uses tunnelling tools and SSH to keep access and pivot, including from ESXi hosts.
- 3
Take Credentials
Extracts credentials from Veeam backup systems and dumps Windows SAM files.
- 4
Disable Defences
Disables endpoint protection using vulnerable drivers or antivirus killers.
- 5
Steal Selected Files
Uses a renamed Rclone to upload selected file types to cloud storage.
- 6
Encrypt
Stops virtual machines, encrypts Windows and ESXi data, and deletes shadow copies.
Key Techniques
Selected from Hive Pro's mapping and Cyber Press's summary.3,5 Abyss has no ATT&CK v20 entry.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | Exploits unpatched VPN appliances. |
| T1572 | Protocol Tunneling | Command and Control | Uses reverse SSH and SOCKS tunnels. |
| T1003.002 | Security Account Manager | Credential Access | Dumps Windows SAM files. |
| T1021.004 | SSH | Lateral Movement | Enables and uses SSH on ESXi hosts. |
| T1685 | Disable or Modify Tools | Defense Impairment | Disables endpoint protection. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Uploads data with Rclone. |
| T1489 | Service Stop | Impact | Stops services and virtual machines. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts Windows and ESXi files. |
Tools Observed
Tunnelling and Credentials
Exfiltration
Vulnerabilities
Hive Pro and Cyber Press name this flaw as a way in:3,5
This is an old flaw, which shows why patching edge devices remains important.
Defences That Matter
Isolate ESXi and NAS
- Put ESXi servers and NAS devices in separate VLANs with strict firewall rules.5
- Disable SSH on ESXi unless it is needed.
Patch Edge Devices
- Regularly update network devices and software.5
- Retire appliances that no longer receive fixes.
Protect Privileged Access
- Use privileged access management and MFA for administrative accounts.5
Defend the Defences
- Enable tamper protection and restrict unsigned drivers.5
- Monitor for rapid file changes and unauthorised SSH activity.5
Are Your ESXi Hosts and NAS Devices Isolated?
We can test how far an attacker could get from an edge device to your virtual infrastructure.
Sources
- SOCRadar: Dark web profile: Abyss ransomware, updated 19 June 2026
- Fortinet FortiGuard Labs: Ransomware Roundup: Abyss Locker, 26 February 2024
- Hive Pro: Threat advisory TA2025038 on Abyss Locker, 12 February 2025
- Hive Pro: Abyss Locker's substantial threat explored, TA2024077, 27 February 2024
- Cyber Press: Abyss Locker ransomware targeting critical network devices, 6 February 2025
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.