The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory (CSA) in response to the ongoing ransomware campaign, known as “ESXiArgs.” Malicious actors may be exploiting known vulnerabilities in VMware ESXi servers that are likely running unpatched and out-of-service or out-of-date versions of VMware ESXi software to gain access and deploy ransomware. The ESXiArgs ransomware encrypts configuration files on ESXi servers, potentially rendering virtual machines (VMs) unusable.
According to VMware, ESXi versions 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, and 6.5 before ESXi650-202102101-SG contain a heap overflow vulnerability in OpenSLP. TAs on the same network as the ESXi machine, which has access to port 427, may be able to exploit this vulnerability to execute code remotely.
CISA has released an ESXiArgs recovery script at github.com/cisagov/ESXiArgs-Recover. Organizations that have fallen victim to ESXiArgs ransomware can use this script to attempt to recover their files. This CSA provides guidance on how to use the script.
ESXiArgs actors have compromised over 3,800 servers globally. CISA and FBI encourage all organizations managing VMware ESXi servers to:
- Update servers to the latest version of VMware ESXi software
- Harden ESXi hypervisors by disabling the Service Location Protocol (SLP) service
- Ensure the ESXi hypervisor is not exposed to the public internet.
- https://us-cert.cisa.gov/ncas/alerts/aa23-039a
- https://blog.cyble.com/2023/02/06/massive-ransomware-attack-targets-vmware-esxi-servers/