The Italian National Cybersecurity Agency (ACN) has issued a warning about a large-scale ransomware campaign targeting VMware ESXi servers worldwide, including Italian systems. The attackers are attempting to exploit the CVE-2021–21974 vulnerability.
Affected Systems
The vulnerability affects the following systems:
- ESXi 7.x versions earlier than ESXi70U1c-17325551
- ESXi versions 6.7.x earlier than ESXi670-202102401-SG
- ESXi versions 6.5.x earlier than ESXi650-202102101-SG
Geographical Distribution of Attacks
Most of the attacks have targeted systems in France, followed by Finland, North America, Canada, and the United States. The alert issued by the agency states that dozens of local organizations have been exposed to ransomware attacks exploiting the vulnerability.
CERT-FR Reports Ransomware Attacks
The ransomware attacks were first reported by the France CERT (CERT-FR). According to the alert published by CERT-FR, the threat actors behind these attacks are actively exploiting the vulnerability CVE-2021-21974. The systems targeted would be ESXi hypervisors in version 6.x and prior to 6.7.
OVHcloud Reports Ongoing Ransomware Attacks
The ongoing ransomware attacks have also been reported by cloud service provider OVHcloud, which observed most of the attacks in Europe.
Linked to New Ransomware Family: ESXiArgs
BleepingComputer has reported that the attacks could be linked to a new ransomware family, tracked by ID Ransomware’s Michael Gillespie as ESXiArgs. The ransomware targets files with the .vmxf, .vmx, .vmdk, .vmsd, and .nvram extensions on compromised ESXi servers and creates a “.args” file for each encrypted document with metadata.
Prevention Measures
Despite international cyber security agencies warning about ongoing cyber attacks exploiting the issue, it is important to note that the success of these campaigns is due to the lack of patch management. The patch for the CVE-2021–21974 bug was released two years ago, however, a large number of systems that are exposed online are yet to be patched.
Government experts urge organizations to immediately apply security patches to address the vulnerability and prevent its exploitation. CERT-FR urges applying all patches available for the ESXi hypervisor and recommends performing a system scan to detect any signs of compromise. It also recommends disabling the SLP service on ESXi hypervisors that have not been updated.
Dimitris is an Information Technology and Cybersecurity professional with more than 20 years of experience in designing, building and maintaining efficient and secure IT infrastructures.
Among others, he is a certified: CISSP, CISA, CISM, ITIL, COBIT and PRINCE2, but his wide set of knowledge and technical management capabilities go beyond these certifications. He likes acquiring new skills on penetration testing, cloud technologies, virtualization, network security, IoT and many more.
