Ransomware attacks targeting servers running VMware ESXi hypervisor are on the rise, posing a significant risk to businesses across the United States. Threat actors are exploiting vulnerabilities in the system, specifically the Open Service Location Protocol (OpenSLP) vulnerabilities CVE-2020-3992 and CVE-2021-21974, to execute a ransomware payload. Once compromised, the ransomware modifies the ESXi configuration and encrypts files associated with virtual machines.
The Nevada ransomware group is believed to be behind these attacks, offering affiliates a locker payload written in Rust for encrypting victim data. While victims receive ransom notes with instructions on how to make payment for file decryption, it remains uncertain whether data has been stolen during these attacks.
To protect against such attacks, organizations using VMware ESXi should ensure their installations are patched and supported by their vendor. Additionally, a temporary workaround is available that disables the vulnerable Service Location Protocol (SLP) service.
The ransomware used in these attacks, known as ESXiArgs, employs a secure encryption process. Victims have reported receiving ransom notes and finding compromised files. However, data exfiltration has not been confirmed at this time.
As the threat continues to grow, it is crucial for businesses to remain vigilant and take proactive measures to safeguard their VMware ESXi systems. By staying up to date with patches and vendor support, organizations can mitigate the risk of falling victim to malicious ransomware attacks.
Understanding the Vulnerabilities
The ransomware groups are taking advantage of unpatched systems vulnerable to OpenSLP vulnerabilities, specifically CVE-2020-3992 and CVE-2021-21974, to execute their malicious payloads. These vulnerabilities in VMware ESXi systems allow threat actors to exploit the Open Service Location Protocol (OpenSLP) and gain unauthorized access to virtual machines.
OpenSLP Vulnerabilities
OpenSLP is an open-source implementation of the Service Location Protocol, which allows network devices to discover and communicate with each other. However, two specific vulnerabilities in OpenSLP, CVE-2020-3992 and CVE-2021-21974, have been identified as entry points for ransomware attacks on VMware ESXi systems.
The CVE-2020-3992 vulnerability allows an attacker to execute arbitrary code by sending a specially crafted message to the affected system. Similarly, the CVE-2021-21974 vulnerability enables an attacker to execute arbitrary code by sending a malicious packet to the system’s OpenSLP service.
Once the ransomware groups exploit these vulnerabilities, they gain control over the ESXi configuration and proceed to encrypt files associated with virtual machines, rendering them unusable until a ransom is paid.
| OpenSLP Vulnerabilities | Description |
|---|---|
| CVE-2020-3992 | Allows for arbitrary code execution through a specially crafted message. |
| CVE-2021-21974 | Enables arbitrary code execution by sending a malicious packet to the OpenSLP service. |
It is crucial for organizations using VMware ESXi systems to be aware of these vulnerabilities and take immediate action to patch their installations. By keeping their systems up-to-date and supported by their vendor, businesses can significantly reduce the risk of falling victim to these ransomware attacks.
Modifying ESXi Configuration and Encrypting Files
Once inside the system, the ransomware payload alters the ESXi configuration and proceeds to encrypt critical files associated with virtual machines, rendering them inaccessible. This malicious attack has exploited vulnerabilities in the Open Service Location Protocol (OpenSLP), specifically CVE-2020-3992 and CVE-2021-21974, which have enabled threat actors to execute a ransomware payload on unpatched VMware ESXi systems.
The ransomware modifies the ESXi configuration, disabling security measures and gaining control over the virtual environment. This allows the attackers to target and encrypt files essential for the proper functioning of virtual machines. As a result, organizations find themselves unable to access their data and experience disruptions in their operations.
Once the ransomware completes the encryption process, it leaves behind ransom notes, providing instructions on how to make payment for file decryption. While these notes instill a sense of urgency, it is crucial to note that data exfiltration in these attacks remains uncertain. Organizations must prioritize strengthening their defenses against these ransomware attacks to prevent further breaches of their virtual environments.
| ESXi Configuration Modification Process | File Encryption Process |
|---|---|
|
|
These attacks have been attributed to the Nevada ransomware group, a threat actor known for their sophisticated techniques. The Nevada ransomware group offers affiliates the use of a Rust locker payload, which further increases the complexity and effectiveness of their encryption methods. This highlights the need for organizations to take proactive measures in patching their VMware ESXi installations, ensuring they have the support of their vendors, and implementing temporary workarounds to disable the vulnerable SLP service.
The Role of the Nevada Ransomware Group
The Nevada ransomware group has emerged as a prominent threat actor, offering affiliates a locker payload written in Rust to carry out their encryption activities. This group has been targeting servers running VMware ESXi hypervisor, taking advantage of vulnerabilities in the system to execute their ransomware payload. By exploiting the Open Service Location Protocol (OpenSLP) vulnerabilities CVE-2020-3992 and CVE-2021-21974, they can gain unauthorized access to vulnerable systems.
Locker Payload and Ransom Note
Once inside the compromised VMware ESXi system, the Nevada ransomware group modifies the ESXi configuration to ensure persistence and control. They then proceed to encrypt files associated with virtual machines, effectively rendering them inaccessible to their owners. Victims are greeted with a ransom note that provides instructions on how to make payment for the decryption key. However, it is important to note that the extent of data exfiltration, if any, remains uncertain at this time.
| Key Points: | Recommendations: |
|---|---|
| The Nevada ransomware group targets VMware ESXi systems | Patch and update your VMware ESXi installations |
| They exploit OpenSLP vulnerabilities CVE-2020-3992 and CVE-2021-21974 | Ensure vendor support for your ESXi installations |
| A locker payload written in Rust is used for encryption | Consider disabling the vulnerable SLP service as a temporary workaround |
Organizations using VMware ESXi should take immediate steps to protect their systems. Patching and updating installations, ensuring vendor support, and implementing the temporary workaround to disable the vulnerable SLP service can significantly reduce the risk of falling victim to the Nevada ransomware group. It is crucial to remain vigilant and follow best practices for cybersecurity to protect valuable data from this growing threat.
Recommendations for Prevention and Protection
To mitigate the risk of VMware ESXi ransomware attacks, organizations are advised to promptly patch their installations, maintain vendor support, and consider implementing a temporary workaround that disables the vulnerable SLP service.
Patching is crucial in keeping VMware ESXi systems secure. By regularly applying the latest updates and security patches, organizations can address known vulnerabilities and protect their virtual infrastructure from exploitation. It is essential to stay vigilant and regularly check for updates provided by VMware to ensure systems are up to date.
Vendor support
Working closely with your vendor is another critical aspect of protecting your VMware ESXi environment. By engaging with your vendor, you can benefit from their expertise and guidance in securing your systems. They can provide valuable insights into the latest threat landscape and offer advice on best practices for securing your infrastructure. It is recommended to maintain a support contract with your vendor to receive timely assistance and updates.
SLP service workaround
A temporary workaround to mitigate the risk of exploitation through the vulnerable SLP service is to disable it until the necessary patches can be applied. By disabling the SLP service, organizations can prevent threat actors from exploiting the OpenSLP vulnerabilities and gaining unauthorized access to their VMware ESXi systems.
However, it is important to note that disabling the SLP service temporarily can impact certain features and functionalities that rely on it. Organizations should carefully evaluate the potential impact on their specific environment and consult with their vendor before implementing this workaround.
By proactively patching installations, maintaining vendor support, and considering the temporary SLP service workaround, organizations can significantly reduce the risk of falling victim to VMware ESXi ransomware attacks. These measures, when implemented collectively, contribute to a robust defense against evolving threats and help ensure the security and integrity of virtual infrastructure.
The ESXiArgs Ransomware and Encryption Process
The ESXiArgs ransomware has been observed in the VMware ESXi attacks, showcasing a robust encryption process while leaving victims with ransom notes and compromised files. This ransomware strain takes advantage of vulnerabilities in the ESXi system, specifically targeting unpatched installations with known vulnerabilities, such as CVE-2020-3992 and CVE-2021-21974.
Once the ESXiArgs ransomware successfully infiltrates a VMware ESXi system, it proceeds to modify the ESXi configuration, enabling it to gain control over the virtual machines hosted on the compromised server. This allows the ransomware to encrypt files associated with these virtual machines, rendering them inaccessible to the victims.
When files are encrypted, the ESXiArgs ransomware generates ransom notes that provide instructions to the victims on how to make payment for file decryption. The ransom notes typically include information on the amount of the ransom and the cryptocurrency wallet address to send the payment. However, it is important to note that despite the presence of ransom notes, it is currently uncertain whether the ransomware operators exfiltrate any data from the compromised systems.
It has been determined that the Nevada ransomware group is likely behind the VMware ESXi attacks. This group offers affiliates a locker payload written in Rust, a programming language known for its reliability and performance. The use of this payload strengthens the encryption process employed by the ESXiArgs ransomware, further complicating the decryption process for victims.
| Key Points | Summary |
|---|---|
| ESXiArgs ransomware | Observed in VMware ESXi attacks |
| Encryption Process | Robust and secure |
| Ransom Notes | Provided with instructions for payment |
| Compromised Files | Victims report inaccessible files |
Uncertainty Surrounding Data Exfiltration
While victims have experienced ransom notes and compromised files, the extent of data exfiltration in VMware ESXi ransomware attacks remains uncertain. These attacks have targeted servers running the VMware ESXi hypervisor and have exploited vulnerabilities in the system.
Threat actors have specifically targeted unpatched systems vulnerable to the Open Service Location Protocol (OpenSLP) vulnerabilities CVE-2020-3992 and CVE-2021-21974. By leveraging these vulnerabilities, the attackers are able to execute a ransomware payload. Once the system is compromised, the ransomware modifies the ESXi configuration and proceeds to encrypt files associated with virtual machines.
Victims receive a ransom note that provides instructions on how to make the payment necessary for file decryption. However, it is currently unclear whether the attackers have also exfiltrated the compromised data. The Nevada ransomware group is believed to be responsible for these attacks, and they offer affiliates a locker payload written in Rust for encrypting victim data.
To protect against these ransomware attacks, it is crucial for organizations using VMware ESXi to ensure that their installations are properly patched and supported by their vendor. Additionally, a temporary workaround is recommended, which involves disabling the vulnerable SLP service.
