EUROPE AND UKRAINE WERE “COVERED” BY HACKER ATTACKS DUE TO AN ENCRYPTION VIRUS. GIGACLOUD TELLS YOU HOW TO PROTECT YOURSELF
On February 3, as a result of a large-scale hacker attack, more than 3,000 business servers around the world were encrypted . According to various estimates , 18,000 servers and thousands of enterprises are at risk , including in Ukraine . Attackers use the ESXiArgs encryption virus , which attacks VMware ESXi servers .
Cloud operator GigaCloud told what kind of virus it is , who is at risk and shared instructions on how businesses can protect their data from malicious software.
WHAT IS ESXIARGS ?
This is a crypto- ransomware that encrypts the data of servers based on the VMware ESXi hypervisor , and then replaces the message at the entrance , replacing it with a ransom demand of several bitcoins .
Malicious software encrypted files with extensions “. vmxf “, “. vmx “, “. vmdk “, “. vmsd ” and “. nvram ” on the compromised ESXi servers and created the file “. args ” for each encrypted document with metadata ( presumably necessary for decryption ) . ESXiArgs left a ransom note on infected systems _ _ $50,000 in Bitcoins , named “ransom.html ” and ” How to Restore Your Files.html” in the format “. html ” or “. txt “. Cyber security experts claim that it is impossible to decrypt the files .
WHEN DID THE VULNERABILITY APPEAR ?
ESXiArgs activity was recorded back in the fall of 2020. VMware then released a patch to address one of the vulnerabilities , but it was incomplete and could be bypassed . Subsequently, it released a second patch, which completely eliminated the vulnerability associated with the possibility of free use ( use-after-free , UAF). She received the code CVE-2020-3992. Eventually, VMware released a third patch that completely eliminates the dynamic memory overflow . It was assigned the code CVE-2021-21974.
In February 2023, two years after the threat was discovered , hackers used the vulnerability to attack unprotected servers .
WHO IS AT RISK ?
First of all , the attack affected and may still affect companies using outdated versions of ESXi — from 6.x to 6.7, as well as some versions of vSphere 7.0 that were not updated to the latest patch . According to Rapid7 estimates , this is almost 18,581 servers worldwide .
I AM A GIGACLOUD CLIENT . IS ESXIARGS A THREAT TO ME ?
No , the ESXiArgs encryptor does not pose any threat to your GigaCloud infrastructure . Our team supports current software versions and closes all vulnerabilities in a timely manner .
VMware released a patch that completely closes this vulnerability on February 23, 2021. At the same time , more than two years ago, we immediately closed it . You always use the most current version without bugs and vulnerabilities .
We remind you that GigaCloud has the highest partner status of VMware Principal Partner, which guarantees our clients high -quality services based on VMware solutions .
WHO WAS HURT ?
The exact number of affected servers and companies is unknown , but there are thousands of them . According to Censys data , 3,200 servers were encrypted in just the first three days of ESXiArgs activity in February 2023 . A third of them were in France , and cases of infection of the Florida Supreme Court, schools and universities in Hungary and Slovakia , as well as business in the USA, Italy , Germany and other countries . There are dozens of cases of infection of servers in Ukraine as well , but companies do not declare this publicly .
HOW TO PROTECT YOURSELF ?
If you are not using our clouds, we recommend upgrading vSphere components to the latest available supported releases ― 7.0 and above . You also need to disable the OpenSLP service in ESXi .
We also advise on an ongoing basis :
These are general tips , and it is not wise to apply them to all users of VMware solutions . Because the security of the IT infrastructure depends on where it is located .
