{"id":50464,"date":"2023-02-07T11:31:26","date_gmt":"2023-02-07T11:31:26","guid":{"rendered":"http:\/\/66fe6f16-a117-45aa-84c2-bf3a2babb05e"},"modified":"2023-02-07T11:31:26","modified_gmt":"2023-02-07T11:31:26","slug":"vmware-warns-of-ransomware-attacks-on-unpatched-esxi-hypervisors","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/vmware-warns-of-ransomware-attacks-on-unpatched-esxi-hypervisors\/","title":{"rendered":"VMware warns of ransomware attacks on unpatched ESXi hypervisors"},"content":{"rendered":"
\n
\n
\"datacenter\"<\/picture><\/div>\n

<\/div>\n

Image: Getty Images\/Morsa Images<\/span><\/figcaption><\/figure>\n

Hypervisor maker VMware has warned that attackers are using previously disclosed vulnerabilities in its ESXi hypervisor and components to deploy ransomware. <\/p>\n

The company believes the vulnerabilities being exploited are not zero-day flaws, meaning the attackers are exploiting previously discovered bugs in the hypervisor. In other words, the attacks exploit instances of the hypervisor that have not been updated or are no longer supported. <\/p>\n

Also: Cloud computing dominates. But security is now the biggest challenge<\/a><\/strong><\/p>\n

“We wanted to address the recently reported ‘ESXiArgs’ ransomware attacks as well as provide some guidance on actions concerned customers should take to protect themselves,” VMware’s security response center said on Monday<\/a>.<\/p>\n

“VMware has not found evidence that suggests an unknown vulnerability (0-day) is being used to propagate the ransomware used in these recent attacks.” <\/p>\n

The company notes that most reports state attacked instances have reached end of support or are significantly out-of-date products. <\/p>\n

It’s reiterating a workaround it gave in December<\/a> for customers to disable the SLP Service on VMware ESXi after OpenSLP vulnerabilities affecting ESXi were disclosed.    <\/p>\n

France’s computer emergency response team (CERT) last week warned<\/a> that it became aware of attack campaigns targeting ESXi hypervisors to deploy ransomware on February 3. The SLP service appeared to have been targeted and allows a remote attacker to run code of their choice on the vulnerable server. It also notes that exploit code has been publicly available since at least May 2021. <\/p>\n

CERT France strongly recommends admins isolate an affected server, reinstall the hypervisor, apply all patches, disable unnecessary services like SLP, and block access to admin services through a firewall. <\/p>\n

Specifically, it recommends the following courses of action: <\/p>\n