Black Arrow Cyber Advisory 06/02/2023 – New Wave of Ransomware Exploiting VMware ESXi Hypervisors - updated 09/02/2023 and 10/02/2023
Updated 10/02/2023
Reports indicate that at least 18,500 ESXi servers are still vulnerable to VMware bug behind initial ransomware spree, after last week’s ransomware infections hit more than 3,800 organisations across the United States, France, Italy and more.
Updated 09/02/2023
It has now been found that there is a second wave of the ransomware campaign and reports from administrators are that they are being breached, even though SLP was disabled. There is also a script released by the Cybersecurity and Infrastructure Agency (CISA) which will attempt to recover files from an impacted VMware ESXi hypervisor. It should be noted however, that it will likely not work if the VMware ESXi hypervisor was hit by the second wave of ransomware.
CISA’s advice and link to their recovery script can be found here: https://www.cisa.gov/uscert/ncas/current-activity/2023/02/08/cisa-and-fbi-release-esxiargs-ransomware-recovery-guidance
Executive Summary
A large ransomware campaign is targeting VMware ESXi hypervisors around the world, according to the French government’s computer emergency readiness team (CERT-FR). Although not officially confirmed by VMware, multiple sources report that the ransomware exploits a vulnerability known as CVE-2021-21974, which is a heap-overflow vulnerability in which exploitation can result in remote code execution. A patch was made available by VMware in February 2021.
What’s the risk to me or my business?
According to VMware, the malicious actor needs to reside within the same network segment as VMware ESXi and have access to port 427 to be able to exploit CVE-2021-21974 and remotely execute code. This exploit only impacts organisations with VMware ESXi where OpenSLP services are in use. OpenSLP is an open-source implementation of the Service Location Protocol (SLP), which is used to allow networking applications to discover the existence, location and configuration of network services within enterprise networks. The impacted versions of VMware ESXi are as follows:
· ESXi 7.x versions earlier than ESXi70U1c-17325551
· ESXi 6.7.x versions earlier than ESXi670-202102401-SG
· ESXi 6.5.x versions earlier than ESXi650-202102101-SG
What can I do?
Organisations should look to apply the available patches from VMware as soon as possible. It is recommended that organisations disable the SLP service on ESXi hypervisors that have not been patched for the mean time. Where a patch has been applied recently, a system scan should be performed to detect any indicators of compromise.
Further information on the vulnerability can be found through the original security advisory from VMware, which was published in February 2021: https://www.vmware.com/security/advisories/VMSA-2021-0002.html
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity