Security researchers have warned of two VMWare ESXi hypervisor flaws that ransomware gangs are using to encrypt virtual hard drives.
The vulnerabilities, CVE-2019-5544 and CVE-2020-3992, exist in the ESXi hypervisor that enables multiple virtual machines (VMs) to share the same storage hardware. The flaws affect the Service Layer Protocol (SLP), which allows computers and other devices to find services in a local area network without prior configuration.
According to reports, hackers have exploited the flaws to send malicious SLP requests to an ESXi device and take it over. Cyber criminals behind the RansomExx ransomware have been launching attacks since October 2020.
The cyber criminals gained access to devices on corporate networks and are using this as a springboard to attack other ESXi VMs and encrypt virtual hard drives.
According to a Reddit post, hackers have encrypted 1,000 VMs at Brazil’s Superior Tribunal de Justica (Brazil’s equivalent of the Supreme Court). Other victims have had VMs shut down and datastores encrypted and left with a ransom note at the datastore level.
Such attacks have been confirmed by security researcher Kevin Beaumont, who said hackers have used these vulnerabilities to bypass Windows security to shut down VMs and encrypt VMDKs directly on the hypervisor.
Currently, security researchers have only observed the RansomExx crime group abusing these flaws. However, researchers also believe the criminals behind the Babuk Locker ransomware have deployed similar tactics.
According to cyber security firm Kela, other cyber criminals have been selling access to ESXi instances on underground forums for thousands of dollars, which could explain the link between the ESXi flaws and the ransomware attacks using them.
System administrators have been urged to update their VMWare ESXi installs or disable SLP support to secure them.
Natalie Page, cyber threat intelligence analyst at Sy4 Security, told ITPro that VMWare is a lucrative platform for attackers to target due to its global prevalence.
“Luckily the recommendations in this instance are pretty straight forward, users of VMWare ESXi should prioritize implementing patches for both CVE-2019-5544 and CVE-2020-3992 or disable SLP support to prevent attacks if the protocol isn't needed,” Page said.
-
Customizing for Every CustomerPersonalise customer experiences at scale with CRM+AI+Data+Trust. True 1-to-1 personalisation is finally possible.
-
The Data Foundation for the Age of AISee how you can build a data strategy for the age of AI. How Data Cloud unifies data for use in personalisation and grounded AI.
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
-
Google cyber researchers were tracking the ShinyHunters group’s Salesforce attacks – then realized they’d also fallen victimNews In an update to an investigation on the ShinyHunters group, Google revealed it had also been affected
-
Nearly one-third of ransomware victims are hit multiple times, even after paying hackersNews Many ransomware victims are being hit more than once, largely thanks to fragmented security tactics
-
75% of UK business leaders are willing to risk criminal penalties to pay ransomsNews A ransom payment ban is a great idea - until you're the one being targeted...
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employeesNews The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crimeNews A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
