Ransomware Groups Exploit VMware ESXi Vulnerabilities

Summary

Ransomware groups are exploiting two critical vulnerabilities, CVE-2019-5544 and CVE-2020-3992 , in VMware ESXi in order to encrypt virtual hard disks. ESXi is a hypervisor that is installed directly on a physical server that consolidates virtual machines in order to share the same hard drive storage, among other features. Researchers spotted the ransomware group RansomExx – also known as Defray777 – exploiting these vulnerabilities in October 2020. Additionally, researchers are aware of the Babuk Locker ransomware operators’ intent to incorporate this exploitation method into future attacks. Threat actors have also been observed selling access to ESXi instances via dark web forums, increasing the likelihood of its use in future attacks.

Recommendations

The NJCCIC urges users of vulnerable VMware ESXi to apply patches after appropriate testing. Additionally, consider disabling Service Location Protocol (SLP) port 427 if possible, as this is a known attack vector. Further reporting can be found in the ZDNet article.