Recently, cybercriminals have been targeting VMware ESXi hypervisors with ransomware attacks. These attacks are believed to be exploiting CVE-2021-21974, which had a patch released on February 23, 2021. VMware's alert stated that the vulnerability was an OpenSLP heap-overflow issue that could lead to the execution of malicious code. If a malicious actor has access to port 427 on the same network segment as ESXi, they can trigger the heap-overflow issue and gain remote code execution. OVHcloud reported that the attacks are being seen globally, with a focus on Europe, and are suspected to be related to a new Rust-based ransomware strain called Nevada. Other ransomware families that have adopted Rust include BlackCat, Hive, Luna, Nokoyawa, RansomExx, and Agenda. The attackers are recruiting both Russian- and English-speaking affiliates to collaborate with Initial Access Brokers on the dark web. The Nevada Ransomware group is also buying compromised access and has a team dedicated to post-exploitation and network intrusions. The ransom notes seen in the attacks do not appear to be related to Nevada ransomware, and the strain is being tracked as ESXiArgs. To protect against potential threats, users should upgrade to the latest version of ESXi and restrict access to the OpenSLP service to trusted IP addresses.
This Cyber News was published on thehackernews.com. Publication date: Sat, 04 Feb 2023 14:30:04 +0000