Kevin BeaumontFeb 3, 2023
I obviously don’t have my tweet thread any more to add to it, but somebody is doing automated destructive attacks on VMware ESXi with 2021 vulns. At the time, to their credit, VMware were very clear in customer comms that not patching could lead to ransomware. #ESXiArgs https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
Massive ESXiArgs ransomware attack targets VMware ESXi servers worldwide

Admins, hosting providers, and the French Computer Emergency Response Team (CERT-FR) warn that attackers actively target VMware ESXi servers unpatched against a two-year-old remote code execution vulnerability to deploy ransomware.

BleepingComputer
Show threadKevin BeaumontFeb 3, 2023
I don’t yet have a sample of the payload, but I know they’re using automated deployment with internet scanning. #ESXiArgs
Show threadKevin BeaumontFeb 3, 2023
#ESXiArgs #ransomware looks to be impacting thousands of ESXi boxes, with the VMs below toast 😬
Show threadKevin BeaumontFeb 3, 2023

#ESXiArgs:

- Not a worm
- Automated attacks but attacker IP running
- Not very skilled
- You can pull attacker IP by running Netflow against impacted boxes (you can pull from Shodan)
- Primary impact SMB MSPs and dedicated server hosts who default VMware insecure on deployment
- Likely off the shelf OpenSLP exploit (eg https://github.com/straightblast/My-PoC-Exploits/blob/master/CVE-2021-21974.py ) based on it only impacting certain version ESXi hosts
- Haven't been able to get binary, but may be Babuk builder, similar to Cheerscrypt mid last year.

My-PoC-Exploits/CVE-2021-21974.py at master · straightblast/My-PoC-Exploits

PoC exploits I wrote. They're as is and I will not offer support - My-PoC-Exploits/CVE-2021-21974.py at master · straightblast/My-PoC-Exploits

GitHub
Show threadKevin BeaumontFeb 3, 2023

Also, obvious point above reiterated - it only appears to be a subset of vuln boxes getting ransom'd. I speculate this is because the public exploit they're potentially using was only tuned to work with certain versions. So it should help reduce the impact somewhat.

In other news, don't open port 427 to the internet, and if you must expose ESXi web servers (port 443) to the internet make sure you patch it.

Show threadKevin BeaumontFeb 4, 2023

Good spot by @gregclermont - alleged #ESXiArgs #ransomware samples

Encryption software binary https://www.virustotal.com/gui/file/11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66/detection

Shell script https://pastebin.com/y6wS2BXh

One caveat - doesn’t appear to contain the ransom note unless I’m thick (I am)

VirusTotal

VirusTotal

Show threadKevin BeaumontFeb 4, 2023

If you want to see the havoc #ESXiArgs is causing, check out this forum topic.. it gets more nuts as the pages go on. https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/

One lesson learnt from this - some cloud providers that offer managed VMware hosting haven’t been patching, and leave all ports open to internet on management IP 🤦‍♀️

Esxi Ransomware Help and Support Topic (ESXiArgs / .args extension) - Ransomware Help & Tech Support

Page 1 of 6 - Esxi Ransomware Help and Support Topic (ESXiArgs / .args extension) - posted in Ransomware Help & Tech Support: Tutorial: How To Decrypt your VMDK affected Files (Post #64)  my files encrypted wmx etc. my wmx filehttps://we.tl/t-A58SoStke7 ransomware note <html lang=en> <head> <title>How to Restore Your Files</title> </head> <body> <h1>How to Restore Your Files</h1> <p><stron...

BleepingComputer.com
Show threadInterpipes 💙
@GossiTheDog where on earth do these incompetents find customers
Feb 4, 2023 at 4:38pmWeb