VMware has warned customers to take action as unpatched ESXi servers are being targeted by ESXiArgs ransomware attacks. Hackers are exploiting CVE-2021-21974, a high-severity ESXi remote code execution vulnerability related to OpenSLP that was patched by VMware in February 2021. After successful exploitation, unidentified threat actors have deployed file-encrypting ransomware that targets virtual machines. Although technical details and a proof-of-concept exploit for CVE-2021-21974 have been available for almost two years, there is no evidence that in-the-wild exploitation has been observed until now. VMware stated in a blog post that there is no indication that the attacks involve exploitation of a zero-day vulnerability. Most reports suggest that End of General Support and/or significantly out-of-date products are being targeted with known vulnerabilities that were previously addressed and disclosed in VMware Security Advisories. The attacks are possible because many organizations are running old and unpatched software. ESXiArgs ransomware attacks seem to have started on or around February 3. As of February 7, Censys shows nearly 2,500 compromised servers and Shodan shows more than 1,600. Most of the hacked systems are located in France, followed by the United States. On compromised systems, the hackers leave a ransom note demanding roughly $50,000 in bitcoins in order to recover their files and prevent them from being leaked. The cybercriminals claim to have stolen data that they will sell unless a ransom is paid, but there is no evidence to date that files have actually been stolen in ESXiArgs attacks. The malware used in these attacks targets files associated with virtual machines. In some cases, the encryption routine can partially fail, which could allow some victims to recover their data without paying a ransom. Recovering files that have been properly encrypted seems impossible for the time being. Cyble has published a technical analysis of the malware, including information on VM configuration file modifications, file encryption, persistence, and cleanup. Government cybersecurity agencies around the world, including in the United States, have issued warnings about the ESXiArgs ransomware attacks.
This Cyber News was published on www.securityweek.com. Publication date: Tue, 07 Feb 2023 15:23:03 +0000