Ransomware Targets Outdated VMware ESXi Hypervisors: Protect Your Systems Now! | Qualys
Summary: A ransomware campaign tracked as ESXiArgs targeted VMware ESXi hypervisors running versions 6.x and before 6.7, exploiting a heap-overflow vulnerability in OpenSLP tracked as CVE-2021-21974, with related flaws CVE-2020-3992 and CVE-2021-21974 in the SLP service. Attackers with access to port 427 on the same network segment could trigger the overflow and execute remote code; the vulnerability was confirmed and weaponized on February 3, 2023, and carries a CVSSv3 score of 8.8.
Bottom line: The flaw's proof of concept was published on February 24, 2021, and it was being used in ransomware attacks roughly two years later - a window that closed only for organizations that had patched. CISA built the ESXiArgs-Recover tool so victims could reconstruct VM metadata from unencrypted disks rather than pay, but it creates new config files and does not delete the encrypted ones.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-3992CVE-2021-21974
- Related
- Grey Noise | Exploit Vector Analysis of Emerging ‘ESXiArgs’ Ransomware (a.k.a. Wow do I hate ESXi Threat Intel [right now]) Cyber Risks ·CVE-2020-3992: VMware ESXi OpenSLP Use-After-Free Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Dark Side Ransomware | Qualys Cyber Risks ·