A malicious ransomware attack has been launched against thousands of servers running the VMware ESxi hypervisor, with many more expected to be affected, according to security experts and national cybersecurity agencies. The Computer Emergency Response Team of France was the first to detect the attack and send out an alert. It is believed that the attack is exploiting the CVE-2021-21974 vulnerability, which was patched on February 23, 2021. This vulnerability affects the Service Location Protocol service and allows attackers to execute arbitrary code remotely. The systems that are being targeted are ESXi hypervisors in version 6.x, prior to 6.7. Reports indicate that servers in France, Germany, Finland, the US and Canada have been compromised, with more than 3,200 servers affected globally. The ransomware note that has been sent to victims demands payment of 2.01584 to a bitcoin wallet, which is different in each ransom note. Security agencies are advising users and administrators to upgrade to the latest version of ESXi and restrict access to the OpenSLP service to trusted IP addresses. Additionally, a full system scan should be performed to detect any signs of compromise. It has been noted that developed countries are often targeted more frequently for ransomware attacks due to their access to resources and bitcoins, as well as their higher density of valuable targets.
This Cyber News was published on www.csoonline.com. Publication date: Mon, 06 Feb 2023 18:52:03 +0000