Cybersecurity agencies globally — including in Italy, France, the US and Singapore — have issued alerts about a ransomware attack targeting the VMware ESXi hypervisor. Credit: Huawei (Since this story was published, the VMware ESXi server ransomware evolved, after a recovery script was released.) A global ransomware attack has hit thousands of servers running the VMware ESxi hypervisor, with many more servers expected to be affected, according to national cybersecurity agencies and security experts around the world. The Computer Emergency Response Team of France (CERT-FR) was the first to notice and send an alert about the attack. “On February 3, CERT-FR became aware of attack campaigns targeting VMware ESXi hypervisors with the aim of deploying ransomware on them,” CERT-FR wrote. Other national cybersecurity agencies — including organizations in the US, France and Singapore — have also issued alerts about the attack. Servers have been compromised in France, Germany, Finland, the US and Canada, according to reports. More than 3,200 servers have been compromised globally so far, according to cybersecurity firm Censys. CERT-FR and other agencies report that the attack campaign exploits the CVE-2021-21974 vulnerability, for which a patch has been available since February 23, 2021. This vulnerability affects the Service Location Protocol (SLP) service and allows attackers to exploit arbitrary code remotely. The systems currently targeted are ESXi hypervisors in version 6.x, prior to 6.7, CERT-FR stated. “The SLP can be disabled on any ESXi servers that haven’t been updated, in order to further mitigate the risk of compromise,” CERT-FR wrote in its notice. An alert from cybersecurity provider DarkFeed over the weekend said that in Europe, France and Germany were most affected by the attack. Most of the servers that were hit in France and Germany were being hosted by hosting providers OVHcloud and Hetzner, respectively, according to DarkFeed. A ransom note issued to the victims of the attack posted publicly by DarkFeed said in part: “Security alert! We hacked your company successfully … Send money within 3 days, otherwise we will expose some data and raise the price.” The note quoted by DarkFeed said to send 2.01584 (about US$23,000) to a bitcoin wallet, but apparently the threat actor is using different wallets to collect fees. “What’s interesting is that the bitcoin wallet is different in every ransom note. No website for the group, only TOX id,” DarkFeed stated. Security agencies globally are offering advice to security teams. Administrators advised to update to latest ESXi version “Users and administrators of affected product versions are advised to upgrade to the latest versions immediately. As a precaution, a full system scan should also be performed to detect any signs of compromise. Users and administrators are also advised to assess if the ransomware campaign-targeted port 427 can be disabled without disrupting operations,” the Singapore Computer Emergency Response Team (SingCERT), said in a notice. Security researchers have been analyzing the attacks since they came to light, issuing similar advice and adding information. “Upgrade to the latest version of #ESXi and restrict access to the #OpenSLP service to trusted IP addresses,” security researcher Matthieu Garin recommended in a Twitter post. Garin also offered information that can be useful to help recover ransomed files. “The attackers only encrypt the config files, and not the vmdk disks where the data is stored. This can definitely be very useful!,” Garin said. Meanwhile, US agencies said they were assessing the impact of the reported incidents. “CISA is working with our public and private sector partners to assess the impacts of these reported incidents and providing assistance where needed,” the US Cybersecurity and Infrastructure Security Agency said in a note to media, according to Reuters. Ransomware attackers often target developed countries, researchers noted. “Developed countries are often targeted more frequently for ransomware attacks because they have more resources and access to bitcoins and are more likely to pay the ransom demands,” said Rahul Sasi, co-founder and CEO at cybersecurity firm CloudSEK. “These countries also tend to have a higher density of valuable targets, such as large corporations and government agencies, that can be impacted by a successful attack. Additionally, developed countries often have more advanced technology infrastructure, making them a more attractive target for cybercriminals looking to exploit vulnerabilities,” Sasi added. Related content interview Strong CIO-CISO relations fuel success at Ally CIO Sathish Muthukrishnan and CISO Donna Hart have forged a partnership steeped in Ally’s culture of radical candor that keeps the financial services firm secure and innovative. By Dan Roberts May 09, 2024 9 mins CIO CSO and CISO IT Leadership news Zscaler shuts down exposed system after rumors of a cyberattack Initially dismissing rumors, Zscaler now says it did have a system exposed but nothing important has been accessed. By Shweta Sharma May 09, 2024 3 mins Data Breach Cyberattacks news Palo Alto launches AI-powered solutions to fight AI-generated cyberthreats The suite is powered by Palo Alto’s proprietary solution, Precision AI, which integrates machine learning, deep learning, and generative AI technologies. By Prasanth Aby Thomas May 09, 2024 3 mins Generative AI Security Software news F5 patches BIG-IP Next Central Manager flaws that could lead to device takeover Two high-risk vulnerabilities could allow attackers to gain full administrative control on devices via leaked password hashes. By Lucian Constantin May 08, 2024 5 mins Threat and Vulnerability Management Cloud Security Vulnerabilities PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe