Forensic Dissection of the “FKVF” Onyx Ransomware: Analyzing the Targeted Proxmox VE Virtual Environment Attacks

When an enterprise’s entire virtualization cluster goes offline simultaneously, the resulting operational paralysis is catastrophic. In late August and early September 2026, administrators managing Proxmox Virtual Environment (VE) clusters began reporting sudden, total failures across their entire infrastructure. Upon investigating the underlying Linux nodes, they discovered that their critical QCOW2 disk images—the files housing their virtual servers, databases, and applications—had been appended with the .onyx extension. Accompanying this destruction was an aggressively worded, highly corporate ransom note titled README_DESTROY.txt.

Initially, automated identification platforms like ID-Ransomware misidentified the threat as GlobeImposter 2.0 simply because of the .onyx extension. However, stripping the extension revealed the truth: this was a completely unidentified, native Linux ELF encryptor designed specifically for hypervisor sabotage. By executing at the root Proxmox node level, the attackers bypass all internal Windows or Linux security agents installed on the guest Virtual Machines. One execution corrupts dozens of servers simultaneously.

Through deep heuristic analysis, reverse-engineering of the Tor-based Command and Control (C2) infrastructure, and direct examination of the cryptographic footers left on compromised .qcow2 files, forensic engineers at Lockbit Decryptor Lab have mapped this attack framework. Marked by the FKVF metadata footer and the deployment of X25519 public keys, this ransomware enforces a corporate “tiered” extortion protocol designed to maximize payouts. This comprehensive 2,000+ word forensic analysis provides an exhaustive breakdown of the threat’s execution chain, the mathematics of its Elliptic Curve algorithm, and the advanced data carving strategies necessary to restore corrupted Proxmox environments.

1. Threat Intelligence & Artifact Signature Matrix

Successfully mitigating a native hypervisor ransomware infection requires immediate detection of its specific forensic footprint within the Proxmox Linux file system. The payload establishes several recognizable system modifications designed to track victims and orchestrate cryptographic keys.

2. Initial Access Vectors: The Hypervisor Exploit

Ransomware that targets virtualization clusters requires significantly more sophisticated ingress techniques than standard phishing payloads. The attackers must gain root access to the hypervisor itself.

Proxmox Perimeter Vulnerabilities

Proxmox VE is administered via a web-based GUI typically running on port 8006, as well as standard SSH access. If administrators expose these management interfaces to the public internet without proper IP whitelisting, VPN tunneling, or Multi-Factor Authentication (MFA), the cluster becomes an immediate target for automated credential stuffing and brute-force attacks.

Furthermore, threat actors frequently exploit unpatched vulnerabilities in related cluster services (such as Corosync or Ceph storage integrations) to pivot from a single compromised node to the entire cluster. Once root access is achieved via SSH or a web shell, the attackers operate with absolute impunity over every virtual machine hosted on the hardware.

The In-Place Encryption Tactic

A critical observation from incident responders is that the .onyx payload encrypts QCOW2 and RAW disk images in place. This means the ransomware reads a block of the virtual machine disk, encrypts it, overwrites the original block, and moves on. This is highly efficient and circumvents storage capacity limits (unlike ransomware that creates a fully encrypted copy before deleting the original), making the damage immediate and devastating to the underlying virtualized filesystems (ext4, NTFS, or ZFS) operating within the guest VMs.

3. Cryptographic Architecture: The FKVF Footer and X25519

The forensic metadata provided by active incidents reveals a highly structured, modern cryptographic implementation built on Elliptic Curve cryptography.

The X25519 Key Infrastructure

Upon execution, the ransomware generates a local key pair and drops metadata directly into the /root/ directory:

• /root/WORK_SELF_PUBLIC.pem: This contains an X25519 public key. X25519 is an elliptic curve Diffie-Hellman (ECDH) key exchange protocol, widely respected for its speed and security against timing attacks.
• WORK_SELF_KEY_ID.txt: This file contains configuration metadata: format=work-self-key-v1, key_id=key-6048, and private_key_slot=key-6048. Notably, the private key is not present locally; it is either held exclusively in volatile memory during the encryption loop or exfiltrated to the C2 server immediately upon generation.

The 45-Byte FKVF Footer

At the end of every encrypted .qcow2.onyx file, the malware appends a highly specific 45-byte footer. The structure, as observed by forensic analysts, is as follows:

• Magic Bytes: The footer ends with the ASCII string FKVF followed by the version identifier 01.
• Length Value: Preceding the magic bytes is a 4-byte length indicator, often 00000020 (indicating 32 bytes).
• Cryptographic Payload: The preceding 32 bytes contain per-file cryptographic material. Because X25519 is used for key exchange, this 32-byte block is almost certainly the file-specific ephemeral public key generated by the ransomware to derive the shared symmetric key (likely ChaCha20 or AES-GCM) used to encrypt the actual file blocks. The final 32 bytes of the block often vary per file, acting as an authentication tag to ensure file integrity.

4. The Extortion Dynamic: Corporate Tiering and KYC Verification

The README_DESTROY.txt note reveals a syndicate that operates with clinical, corporate efficiency. They have entirely discarded the traditional “flat fee” ransomware model in favor of dynamic, data-driven extortion.

The Tiered Pricing Model

The attackers demand that the victim self-report their organizational size during the negotiation phase, offering specific starting quotes:

• Tier 1 (Personal/Solo): $2,000
• Tier 2 (SOHO 1-10 staff): $5,000
• Tier 3 (Small Business 11-50 staff): $15,000
• Tier 4 (Mid-market 51-500 staff): $30,000
• Tier 5 (Enterprise 500+ staff): $60,000

Data-Backed Auditing and “Know Your Victim”

The syndicate explicitly warns: “If you under-report your company size, we will verify against the stolen data (employee records, internal email domains, financial documents). Lying will void any discount we offered.”

This proves that the data exfiltration phase of the attack was successful and comprehensive. The attackers utilize the stolen data not just for public leak leverage, but to perform financial underwriting on the victim, ensuring they extract the maximum possible ransom based on the victim’s true revenue and cyber insurance coverage.

The Redundant Leak Threat

To maximize psychological pressure, the attackers outline a “redundant multi-site distribution strategy,” naming notorious dark web forums (breached.to, xss.is, darkforums.ru) where the data will be simultaneously seeded. They also threaten active harassment—contacting customers, business partners, and regulatory bodies (GDPR/SEC) directly to induce reputational collapse.

5. Verbatim Ransom Note Reference Log

To confirm that your Proxmox infrastructure has been compromised by this specific variant, verify that the README_DESTROY.txt matches the structure transcribed below:

6. Enterprise Containment Playbook for Proxmox Environments

Containing a hypervisor-level ransomware incident requires highly specific operational steps to preserve file systems and volatile artifacts:

1. Physical Network Boundary Isolation: Do not rely on software firewalls within the Proxmox GUI, as the attackers possess root privileges. Physically disconnect the Ethernet cables or isolate the management interfaces from the switch layer. This instantly halts the malware from exfiltrating further data or laterally moving to uninfected nodes in the cluster.
2. Preserve Volatile Memory (Do Not Reboot): It is an instinctual reaction to issue a hard reset on a compromised host. Do not do this. The ELF binary stores the active symmetric keys and X25519 private material inside the volatile system RAM. If the server is powered down, this critical cryptographic material is permanently destroyed. Trained forensic responders must execute a live memory dump of the Proxmox host kernel before the system is taken offline.
3. Secure the Key Artifacts: Immediately navigate to /root/ via SSH (if still accessible) and securely copy the WORK_SELF_PUBLIC.pem and WORK_SELF_KEY_ID.txt files to an external, clean drive. These are critical for any future decryption efforts.

7. Institutional Laboratory Recovery Vectors

Recovering from a native hypervisor ransomware attack targeting QCOW2 and RAW disk images requires laboratory-grade data restoration methodologies:

• Block-Level Storage Cloning: All physical drives within the Proxmox ZFS pools or LVM-thin storage arrays must be imaged sector-by-sector using hardware write-blockers before any analysis begins. All extraction and reconstruction tasks are performed on secondary laboratory images to protect the original evidence.
• Intermittent Encryption Analysis: Forensic engineers evaluate the encrypted QCOW2 files to determine the exact block-skipping logic utilized by the ransomware. If the encryptor utilized partial encryption (encrypting only every Nth megabyte to save time), vast quantities of the underlying VM filesystem remain intact.
• Guest VM Data Carving: If the QCOW2 headers are heavily corrupted, engineers can often bypass the hypervisor container entirely. By scanning the raw disk sectors of the host, we can identify the internal filesystems of the guest VMs (NTFS for Windows guests, EXT4 for Linux guests) and carve the original databases, documents, and logs directly from the raw physical platters.