VMware ESXi is by and large the most popular and widely used virtualization software platforms in the world. It provides businesses with a robust and scalable solution for virtualizing their infrastructure and running multiple virtual machines on a single physical host. However, popularity and wide spread use oftentimes comes with a target on your back. And this week, VMware ESXi has been targeted by malicious actors who have developed a new form of ransomware known as VMware ESXiArgs.
First flagged late Feb. 3 by the French Computer Emergency Response Team (CERT-FR), more than 3,800 VMware servers across the US, Canada, Finland, France, and Germany have already reportedly been compromised.
VMware ESXiArgs ransomware is a type of malware that is specifically designed to attack VMware ESXi servers. This type of ransomware infects the virtual machines running on the ESXi host, encrypting all of the data on those machines and making it inaccessible to the users. The attackers then demand a ransom payment from the victims in exchange for the decryption of their data. A copy of the alleged ransom note, shared by threat intelligence provider DarkFeed, shows that those behind the attack have adopted a “triple-extortion” technique, in which the attackers threaten to notify victims’ customers of the data breach. And they are demanding 2.06 bitcoin ($19,000) in ransom payments from companies.
According to a VMware spokesperson, ESXiArgs appears to be targeting end of general support or significantly out of date products by leveraging known vulnerabilities previously addressed and disclosed in VMware security advisories.
Threat actors can exploit the known heap-overflow vulnerability in VMware’s OpenSLP service, CVE-2021-21974, to gain access and initiate attacks. Given the age of the vulnerability, nearly two years old now, it is likely that many organizations have already patched their ESXi servers. However, we know that this isn’t the case for 100% of the servers that are out there.
The following ESXi versions are said to be vulnerable to CVE-2021-21974:
- ESXi versions 7.x prior to ESXi70U1c-17325551
- ESXi versions 6.7.x prior to ESXi670-202102401-SG
- ESXi versions 6.5.x prior to ESXi650-202102101-SG
“VMware has not found evidence that suggests an unknown vulnerability (0-day) is being used to propagate the ransomware used in these recent attacks,” writes Edward Hawkins of the VMware Security Response Center. “Most reports state that End of General Support (EOGS) and/or significantly out-of-date products are being targeted with known vulnerabilities which were previously addressed and disclosed in VMware Security Advisories (VMSAs).”
To protect against VMware ESXiArgs ransomware, it is important to implement a number of security measures. This includes having robust backup and disaster recovery plans in place, as well as ensuring that all software and systems are kept up-to-date with the latest security patches. VMware customers should upgrade to the latest available supported releases of vSphere components to address currently known vulnerabilities.
Caitlin Condon, Senior Manager, Vulnerability Research at Rapid7, offers the following advice: “ESXi customers should ensure their data is backed up and should update their ESXi installations to a fixed version on an emergency basis, without waiting for a regular patch cycle to occur. ESXi instances should not be exposed to the internet if at all possible. And administrators should also disable the OpenSLP service if it is not being used.”
In 2021, ESXi 7.0 U2c and ESXi 8.0 GA began shipping with the service disabled by default.
In addition, businesses should implement email filtering and anti-spam solutions to help prevent phishing attacks from reaching their employees. This can help to prevent the spread of ransomware through phishing emails.
It is also important to regularly scan for vulnerabilities in the VMware ESXi servers and to implement security measures to reduce the risk of exploitation. This can include implementing firewalls and intrusion detection systems, as well as conducting regular security audits to identify any potential security weaknesses.
In an effort to help, The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a script to recover VMware ESXi servers encrypted by the VMware ESXiArgs ransomware attacks. The CISA script cleans up a virtual machine’s encrypted files and attempts to rebuild the machine’s .vmdk file using the unencrypted flat file.
Morten Gammelgard EVP, EMEA, at BullWall, said “We got lucky this time. The attackers failed to encrypt the flat data files where the data for virtual disks are stored. While these recent attacks on VMware servers were only partially successful, it highlights the issues with protecting the entire attack surface and maintaining perfect cyber hygiene – the next attack may work better and successfully encrypt all files and perhaps next time a rescue script will not be available.”
Gammelgard went on to say, “Companies must patch all critical OS and application vulnerabilities in a timely manner and deploy ransomware containment to stop the encryption from happening – when the ransomware bypasses all the preventative security tools – by taking advantage of an old or new vulnerability. Had this attack been more successful, many more organizations would now be facing downtime and disruption and having to restore lots of files and environments from back up at very high cost.”
The identity of the adversaries behind the campaign remains unclear.
