Luna
- Malware type
- ransomware
- Last IoC activity
- 2026-07-20 09:50:00
- Profile updated
- 2026-07-07 13:43:36
Targeted industries: government-and-public-sector energy-and-utilities technology-and-telecommunications
Context
Luna is a ransomware targeting ESXi servers, written in Rust programming language. It is designed to encrypt data on affected systems and demand a ransom for decryption.
Detection coverage
- 1 YARA rules
Detection rules
- ARKBIRD_SOLG_MAL_Luna_Stealer_Apr_2021_1 (yara-rule)
Reports & references
- blogs.vmware.com — Esxi Targeting Ransomware The Threats That Are After Your Virtual Machines Part 1 (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Luna (report)
- nikhilh-20.github.io — Luna Ransomware (report)