ESXiArgs Ransomware Targets VMware Vulnerability

ESXiArgs Ransomware – How to Protect Your Organization

In case you haven’t heard by now, the recently discovered ESXiArgs ransomware attack is quickly becoming a big deal. It has impacted thousands of servers worldwide, specifically targeting nearly ubiquitous VMware ESXi hypervisor and ESXi servers, and as such, VMware has issued a critical alert regarding this vulnerability.

The vulnerability allows attackers to execute malicious code on the affected systems and potentially compromise sensitive data. The attacks are purportedly targeting servers that have remained unpatched against a vulnerability first revealed in 2021. The vulnerability specifically affects the OpenSLP service in older versions of ESXi and can be exploited to enable the remote execution of code to enable Command and Control (C2).

VMware released a statement declaring they have found no evidence that the attack disseminating the ransomware is from an unspecified vulnerability (0-day). Rather, the attack bases itself on a previously known vulnerability (CVE-2021-21974) disclosed and addressed by VMware on 23 February 2021. They add that thus far, only significantly out-of-date products or those already reaching End of General Support (EOGS) have been affected or are believed to be potentially vulnerable.

VMware Recommendations to Protect Against the Vulnerability

VMware advises all customers to upgrade to the latest supported releases of vSphere components to address these currently known vulnerabilities. In addition, VMware has recommended disabling the OpenSLP service in ESXi. OpenSLP has been disabled by default since 2021, beginning with ESXi 7.0 U2c and ESXi 8.0 GA.

Long-term Protection Against Ransomware

Incidents involving ransomware continue to accelerate, doubling the number of attacks from 2021 to 2022. This trend is a cause for concern for businesses and organizations, as they risk losing sensitive information and experiencing costly downtime. The good news is that there are steps organizations can take to protect themselves against ransomware attacks. These steps include implementing an effective patch management system, having efficient and accessible Disaster Recovery (DR) backups and developing incident response (IR) plans.

• Patch Management– One of the principal ways organizations can protect themselves against ransomware attacks is by promptly patching and updating their systems. Upon identification, vulnerabilities in software become a target for cybercriminals, who can exploit these weaknesses to launch attacks. According to a study by the Ponemon Institute, 57% of cyberattack victims report their breaches could have been prevented by installing an available patch (i.e., ESXiArgs ransomware), with 34% of those victims knowing of the vulnerability but failing to take action. Organizations must keep their systems up to date with the latest security patches. Unfortunately, neglecting patching systems is an all too common practice, making it extremely important for organizations to prioritize this aspect of their IT hygiene.
• Disaster Recovery– Another critical aspect of protecting against ransomware attacks is having reliable DR backups. A robust DR plan helps companies mitigate the impacts of a ransomware attack by providing a roadmap for quickly and effectively responding to the incident. DR plans may also include steps to prevent the ransomware spread, restore data and systems from backups, and ensure business continuity. A well-designed DR backup plan can also provide companies with the means to recover their data and systems without paying the ransom, reducing the risk of becoming a repeat target for cyber-criminals. By neglecting DR, companies put themselves and their operations at significant risk, often leading to costly financial impacts.
• Incident Response– Having an IR plan is a fundamental component of cybersecurity protection. This detailed set of procedures outlines the steps a company should take in the event of a security incident, including ransomware attacks. IR plans provide a clear and concise roadmap for responding to security incidents, including guidelines for identifying and containing the attack, recovering data and systems, and preventing future incidents. Thus, companies can minimize the risk of confusion and delays, further exacerbating an already stressful situation. IR procedures also help ensure that all stakeholders, including IT and security personnel, management, and other key employees, are aware of their roles and responsibilities in the event of an attack.

Additionally, a detailed IR strategy helps companies quickly and effectively contain the ransomware attack and prevent its spread to other systems and networks. This decisive action helps reduce the attack’s impact and minimize the risk of data loss. The plan can also assist companies in reclaiming their data and systems via the above-mentioned disaster recovery backups, allowing for the restoration of normal operations with minimal downtime or financial impact.

Protecting Your Organization with OneNeck

Protecting your organization from cyberattacks, including ransomware, is a complex process that requires significant time, staffing and financial resources. For many, the most effective and cost-efficient way to meet these demands is by working with an experienced partner.

OneNeck’s managed backup and disaster recovery services guarantee quick recovery of critical data, minimizing downtime and, most importantly, keeping your business up and running. Our experienced team will monitor and manage your backup solution, protecting your data and ensuring it runs efficiently. Our DR services set up, manage and test recovery solutions to ensure your organization is fully protected when a disaster occurs.

OneNeck’s incident response plans are carefully designed, real-world-tested and updated to fit organizational needs. We help revise existing IR plans or write new ones from scratch, evaluate existing procedures, and lead tabletop exercises to test resiliency. Each engagement reduces the risk of confusion, delay, and further damage while ensuring a quick and effective response that protects your data, systems, and operations.

Patching is critical to ensuring any organization’s security and safety. Though simple in concept, the execution of patching activities is often neglected due to its complex and time-consuming nature. OneNeck’s experienced team provides patch management solutions alongside comprehensive systems management. We have extensive knowledge across numerous industries and platforms, allowing us to provide solutions tailored to your organizational needs and allowing your staff to remain focused on mission-critical business activities.

Contact Us today to speak with a member of our experienced team to help secure your organization against the ESXiArgs ransomware attack and ensure ample preparation for future incidents.

Frequently asked questions…

What is OpenSLP used for in ESXi?

In ESXi, OpenSLP is utilized to enable the discovery of other ESXi hosts and vCenter Servers, as well as for integration with various management tools that use OpenSLP for resource discovery and management.

Does ransomware affect ESXi?

ESXi, as a bare-metal hypervisor, is less susceptible to ransomware attacks compared to traditional operating systems as it has a smaller attack surface and lacks direct user access. However, ransomware attacks can still potentially compromise ESXi hosts through vulnerabilities in the management interfaces or by encrypting virtual machines running on the hosts.

Is ESXi secure?

ESXi is designed with security in mind and includes various security features, such as secure boot, lockdown mode, role-based access control, and encrypted VMotion, to protect against threats. However, as with any software, there may be vulnerabilities that could be exploited. It is crucial to regularly apply security patches and updates and follow security best practices to ensure the security of ESXi hosts and virtual machines.

Can ransomware affect VMware?

Yes, ransomware can affect VMware environments by encrypting virtual machines, disrupting operations, and potentially spreading to other hosts and VMs. It is crucial to have proper security measures, such as network segmentation, access control, and backups, in place to protect against such attacks, and to regularly update and patch VMware products to address any security vulnerabilities.

 

Additional Resources: