Black Arrow Cyber Advisory 27/05/2022 – Trend Micro identified a new Ransomware strain specifically targeting VMware servers

Executive Summary

Ransomware specifically designed to target VMware systems has been found to be in use by malicious attackers. VMware systems have been a prime target for attackers, as many different services which organisations rely on run on these systems. By compromising these systems, all of the hosted services can also be impacted.

What’s the risk to me or my business?

This attack works by shutting down virtual machines running on a VMware system, and encrypting them before demanding a ransom. If the ransom is not paid within three days, then there is a further threat to release the data which the attacker has exfiltrated. This requires an attacker to be able to gain prior access to the system, and to enable ‘Shell’ access to run the malicious script.

What can I do?

Ensure that appropriate security measures are applied to these critical systems, to prevent an attacker from being able to access them. This includes up to date patching of the systems, and appropriate network segregation to prevent end user devices from being able to access the systems. Ensure that Shell access to the server is not left enabled.

The adoption of a security framework such as NIST CSF would greatly assist with applying appropriate controls to prevent this type of attack.

Technical Summary

Trend Micro has conducted the research into this specific strain of ransomware. This strain works by accessing VMware Servers using Secure Shell (SSH), and running a script which shuts down all active virtual machines in order to encrypt them, with the file extension ‘.cheers’. It is worth noting that the renaming of the files happens before the encryption starts, so it is possible that a file is renamed but is in fact not encrypted due to a permissions issue on the account logged in via SSH.

A full break down of the attack can be read here: New Linux-Based Ransomware Cheerscrypt Targets ESXi Devices (trendmicro.com)

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity