CERT France alerts on attacks targeting VMware ESXi

CERT-FR warns that threat actors are targeting VMware ESXi servers to deploy ransomware by actively exploiting a bug tracked as CVE-2021-21974

The vulnerability is an OpenSLP heap-overflow flaw in VMware ESXi that can be exploited by attackers to execute arbitrary code remotely on vulnerable devices using port 427.

The vulnerability affects the following systems:

• ESXi 7.x versions earlier than ESXi70U1c-17325551
• ESXi versions 6.7.x earlier than ESXi670-202102401-SG
• ESXi versions 6.5.x earlier than ESXi650-202102101-SG

On February 3, 2023, CERT-FR became aware of attack campaigns targeting VMware ESXi hypervisors with the aim of deploying ransomware on them. In the current state of investigations , these attack campaigns seem to exploit the CVE-2021-21974 vulnerability, for which a patch has been available since February 23, 2021. This vulnerability affects the Service Location Protocol ( SLP ) service and allows an attacker to remotely exploit arbitrary code. The systems currently targeted would be ESXi hypervisors in version 6.x and prior to 6.7.

CERT-FR urges applying all patches available for the ESXi hypervisor. It also recommends performing a system scan to detect any signs of compromise. Devices that are not updated need to disable the SLP service.

Some of the experts say Nevada ransomware is behind the attack. Around February 1, 2023 – the group distributed an updated locker written in Rust for their affiliates supporting Windows, Linux and ESXi

But as first reported by BleepingComputer the attacks could be linked to a new ransomware family, tracked as ESXiArgs. The ransomware targets files with .vmxf, .vmx, .vmdk, .vmsd and .nvram extensions on compromised ESXi servers and creates a .args file for each encrypted document with metadata.