Hackers encrypt virtual hard disks using two VMWare ESXi vulnerabilities
Hypervisor flaws enable hackers to send requests to devices and take control
Security researchers have warned of two VMWare ESXi hypervisor flaws that ransomware gangs are using to encrypt virtual hard drives.
The vulnerabilities, CVE-2019-5544 and CVE-2020-3992, exist in the ESXi hypervisor that enables multiple virtual machines (VMs) to share the same storage hardware. The flaws affect the Service Layer Protocol (SLP), which allows computers and other devices to find services in a local area network without prior configuration.
According to reports, hackers have exploited the flaws to send malicious SLP requests to an ESXi device and take it over. Cyber criminals behind the RansomExx ransomware have been launching attacks since October 2020.
The cyber criminals gained access to devices on corporate networks and are using this as a springboard to attack other ESXi VMs and encrypt virtual hard drives.
According to a Reddit post, hackers have encrypted 1,000 VMs at Brazil’s Superior Tribunal de Justica (Brazil’s equivalent of the Supreme Court). Other victims have had VMs shut down and datastores encrypted and left with a ransom note at the datastore level.
Such attacks have been confirmed by security researcher Kevin Beaumont, who said hackers have used these vulnerabilities to bypass Windows security to shut down VMs and encrypt VMDKs directly on the hypervisor.
Currently, security researchers have only observed the RansomExx crime group abusing these flaws. However, researchers also believe the criminals behind the Babuk Locker ransomware have deployed similar tactics.
According to cyber security firm Kela, other cyber criminals have been selling access to ESXi instances on underground forums for thousands of dollars, which could explain the link between the ESXi flaws and the ransomware attacks using them.
System administrators have been urged to update their VMWare ESXi installs or disable SLP support to secure them.
Natalie Page, cyber threat intelligence analyst at Sy4 Security, told ITPro that VMWare is a lucrative platform for attackers to target due to its global prevalence.
“Luckily the recommendations in this instance are pretty straight forward, users of VMWare ESXi should prioritize implementing patches for both CVE-2019-5544 and CVE-2020-3992 or disable SLP support to prevent attacks if the protocol isn't needed,” Page said.
-
The evolving role of the CISO and how it impacts channel partnersIndustry Insights The traditional IT sales cycle is being rewritten as CISOs emerge as the most important stakeholders for channel partners to align solutions with
-
How businesses can use storytelling to drive AI adoption among their workforceMany employees are still resisting AI tools, but narrative-led communication is more likely to get their buy-in than data and spreadsheets
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
