ESXi ransomware campaign strikes Florida Supreme Court, worldwide universities

Florida’s Supreme Court is the latest high-profile target in the ongoing ransomware campaign targeting unpatched WMware ESXi servers.

A host of US and EU-based academic institutions are also among those that have been affected by attacks, according to reports from Reuters.

A spokesperson for the Florida Supreme Court told the publication that infrastructure affected in the attack was used to support elements of the Florida state court system.

However, they insisted that this was “segregated” from the Supreme Court’s main networks and as such the integrity of the state court system has not been compromised.

“Florida Supreme Court’s network and data are secure,” the spokesperson said.

The extent of the damage caused by ransomware attacks on academic institutions, which are believed to be based in Hungary, Slovakia, and the US states of Texas and Georgia, is yet to be fully realised.

These incidents represent just a few in a growing list of organisations worldwide that have been affected by the spread of ESXiArgs ransomware.

Data compiled by the crowdsourced Ransomwhere project - which tracks ransomware payments made worldwide - and collected from Censys and Shodan, revealed that, so far, more than 2,800 organisations have been impacted by the ongoing attacks.

Despite this, Ransomwhere's analysis found that only $88,000 had been successfully extorted by cyber criminals from a total of four completed payments.

Given that the attacks only started in the last couple of days, it's likely that future attacks will also lead to additional payments being made.

Xavier Bellekens, CEO of Lupovis, said attackers behind this escalating campaign appear to have used “automated tests” to identify vulnerable ESXi servers and exploit vulnerabilities to launch the ESXiArgs ransomware.

“Over the course of the weekend, Lupovis has seen numerous new IPs scanning and exploiting the vulnerability, with attackers acting quick to catch organisations out before they have time to apply the patch.”

ESXi attacks come as no surprise

Hundreds of organisations were targeted in the wake of the vulnerability disclosure. However, the situation appears to be escalating further and recent attacks could represent the just tip of the iceberg, according to security experts.

John Fokker, head of threat intelligence at Trellix, said the spate of attacks in recent days should come as no surprise given the sheer volume of organisations that could be targeted by threat actors.

“The VMware ESXi server vulnerabilities had already been leveraged by threat actors for years and it was only a matter of time before a major attack was executed,” he said.

Fokker added that Trellix's analysis of the incident shows that the “scale and distribution of the machine detections are truly global in nature and across most verticals”.

“It’s probable that organisations hadn’t applied last year’s patch and were unaware they were running a vulnerable system which left them open to attack,” he noted.

Mitigating threats

In response to the ESXiArgs ransomware campaign, the US Cybersecurity and Infrastructure Agency (CISA), released a script to recover servers impacted by attacks.

The ESXiArgs-Recover script, which can be found on GitHub, enables affected businesses to automate the recovery process, and was compiled based on publicly available resources, including a tutorial by Enes Sonmez and Ahmet Aykac, CISA said.

“This tool works by reconstructing virtual machine metadata from virtual disks that were not encrypted by the malware,” the agency said.

CISA added that it is aware that “some organisations have reported success in recovering files without paying ransoms”.