Grey Noise | Exploit Vector Analysis of Emerging ‘ESXiArgs’ Ransomware (a.k.a. Wow do I hate ESXi Threat Intel [right now])
Summary: GreyNoise examined the ESXiArgs ransomware campaign, which creates files with a .args extension and was flagged by OVH on February 3rd, 2023, and found that while third-party sources attribute it to CVE-2021-21974, a heap-overflow flaw in VMware ESXi's OpenSLP service, no first-party source confirms that vector. GreyNoise notes that CVE-2019-5544 and CVE-2020-3992 also affect ESXi's OpenSLP service, and that most observed CVE-related traffic comes from benign security companies scanning for the vulnerability.
Why it matters: Defenders are being pointed at a single CVE while the actual initial access vector remains unconfirmed, and GreyNoise's own records show only 2 IPs exploiting CVE-2021-21974 in the first half of 2021, each for a single day. A connection to ESXi on TCP/427 from an IP that returns no GreyNoise results is targeted at your organization, not the internet at large.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5544CVE-2020-3992CVE-2021-21974
- Related
- Ransomware Targets Outdated VMware ESXi Hypervisors: Protect Your Systems Now! | Qualys Cyber Risks ·Dark Side Ransomware | Qualys Cyber Risks ·CVE-2020-3992: VMware ESXi OpenSLP Use-After-Free Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021