Recently, a large-scale ransomware attack targeted over 3,000 VMware ESXi servers, using a new version of the ESXiArgs ransomware. It was initially thought that the devices were breached using old VMware SLP vulnerabilities, although some victims reported that SLP was disabled on their devices and they were still affected. The ransomware encrypts files in 1MB increments, and for larger files, it alternates between encrypting 1MB and skipping chunks of data. This means that a lot of data remains unencrypted, which researchers used to create a script to recover virtual machines. However, a second wave of the ESXiArgs ransomware has now been detected, which has a modified encryption routine that encrypts far more data in large files. This makes it much harder, if not impossible, to recover the encrypted virtual machines. The ransom note has also been changed, as it no longer includes bitcoin addresses. It is unclear how the server was breached if SLP was disabled, but it is recommended to try and recover the encrypted ESXi servers using CISAs recovery script.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 09 Feb 2023 03:45:02 +0000