The latest news in Europe regarding cybersecurity is the VMWare ESXi ransomware that is spreading quickly. CERT-FR, the French government's computer emergency response team, issued a bulletin warning of the vulnerability. The ransomware is known as 'rançongiciel' in French, which translates to 'ransomware' in English. The attack is not a zero-day situation, as the vulnerabilities were documented and patched by VMware two years ago. If the necessary patches have not been applied, the system is at risk of not only this ransomware attack, but also other cybercrimes such as data stealing, cryptomining, keylogging, database poisoning, point-of-sale malware and spam sending. The ransomware is a shell script and a Linux program, and it uses the 'esxcli storage filesystem list' command to get a list of ESXi volumes to attack. It then uses a program called 'encrypt' to scramble each file individually. The ransomware also changes system files to make sure the user knows what to do next. To protect against this attack, VMware recommends patching if possible, or disabling the affected SLP service. It is also important to have a reliable and effective way to recover lost data in case of a ransomware attack.
This Cyber News was published on nakedsecurity.sophos.com. Publication date: Wed, 08 Feb 2023 02:58:03 +0000