{"id":50433,"date":"2023-02-06T18:44:00","date_gmt":"2023-02-06T18:44:00","guid":{"rendered":"https:\/\/www.csoonline.com\/article\/3687095\/massive-ransomware-attack-targets-vmware-esxi-servers-worldwide.html#tk.rss_security"},"modified":"2023-02-06T18:44:00","modified_gmt":"2023-02-06T18:44:00","slug":"massive-ransomware-attack-targets-vmware-esxi-servers-worldwide","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/massive-ransomware-attack-targets-vmware-esxi-servers-worldwide\/","title":{"rendered":"Massive ransomware attack targets VMware ESXi servers worldwide"},"content":{"rendered":"
<\/div>\n

A global ransomware<\/a> attack has hit thousands of servers running the VMware ESxi hypervisor, with many more servers expected to be affected, according to national cybersecurity agencies and security experts around the world.<\/p>\n

The Computer Emergency Response Team of France (CERT-FR) was the first to notice and send an alert about the attack.<\/p>\n

\u201cOn February 3, CERT-FR became aware of attack campaigns targeting VMware ESXi hypervisors with the aim of deploying ransomware on them,\u201d CERT-FR wrote<\/a>. <\/p>\n

Other national cybersecurity agencies \u2014 including organizations in the US, France and Singapore \u2014 have also issued alerts about the attack. Servers have been compromised in France, Germany, Finland, the US and Canada, according to reports.<\/p>\n

More than 3,200 servers have been compromised globally so far, according to cybersecurity firm Censys.<\/a><\/p>\n

CERT-FR and other agencies report that the attack campaign exploits the CVE-2021-21974 vulnerability, for which a patch has been available since February 23, 2021. This vulnerability affects the Service Location Protocol (SLP) service and allows attackers to exploit arbitrary code remotely. The systems currently targeted are ESXi hypervisors in version 6.x, prior to 6.7, CERT-FR stated. <\/p>\n