Cheers
- First seen
- 2022-05-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:49:10
Targeted industries: healthcare-and-pharmaceutical financial-services manufacturing transportation-and-logistics
Context
Cheers is a Linux-based ransomware variant observed starting in May 2022, engineered specifically to target VMware ESXi servers. The malware was developed from leaked Babuk ransomware source code and leverages the SOSEMANUK stream cipher combined with ECDH key exchange for encryption. It terminates all running virtual machines before renaming and encrypting log files and VM-related extensions—like .vmdk, .vmsn, and .vswp—appending a .Cheers extension. A ransom note titled "How To Restore Your Files.txt" is dropped per directory. The ransomware is attributed to the Chinese-affiliated group BRONZE STARLIGHT (also known as Emperor Dragonfly, DEV-0401), which has previously deployed other strains like Rook, NightSky, and Pandora. Cheers targets a range of industry sectors, with confirmed victims across healthcare, finance, logistics, and manufacturing.
Reports & references
- ransomlook.io — Cheers (report)
- watchguard.com — Cheerscrypt (report)
- Trend Micro — New Linux Based Ransomware Cheerscrypt Targets Exsi Devices (report)
- sentinelone.com — Cheerscrypt (report)
- sygnia.co — Revealing Emperor Dragonfly A Chinese Ransomware Group (report)
- heimdalsecurity.com — Cheerscrypt Ransomware Strain Attributed To Chinese Hacking Group (report)