European cybersecurity authorities are warning of a large-scale attack on a two-year-old VMWare ESXi vulnerability by ransomware actors. This campaign has been named ESXiArgs because the ransomware creates an additional file with the extension. Thousands of servers in Europe and North America have already been compromised, according to Censys searches. The vulnerability, assigned CVE-2021-21974, was patched in February 2021, but government agencies and cybersecurity experts are urging administrators to update unpatched servers immediately. The vulnerability was first discovered by Mikhail Klyuchnikov of Positive Technologies, a Russian cybersecurity firm. A proof-of-concept exploit has been available since May 2021, although it is not known if this is the same exploit being used in the ESXiArgs campaign. The vulnerability is being exploited to release ransomware, according to the Italys National Cybersecurity Agency. France's computer emergency response team also issued a bulletin about the campaign to warn of the ransomware attack. The updates should be installed immediately, and servers that have not been updated can be assumed to be hacked.
This Cyber News was published on therecord.media. Publication date: Mon, 06 Feb 2023 21:24:03 +0000