• Language chooser
    • USA (English)
    • France (Français)

virus logo Outbreak Alert

VMware ESXi Server Ransomware Attack

Released: Feb 06, 2023

Updated: Feb 08, 2023

Download PDF »

ESXiArgs Ransomware

High Severity

ESXi/HyperV Platform

VMware Vendor

Attack, Ransomware Type

Ransomware targeting VMware ESXi OpenSLP vulnerability

ESXi servers vulnerable to the OpenSLP heap-overflow vulnerability (CVE-2021-21974) and OpenSLP remote code execution vulnerability (CVE-2020-3992) are being exploited through the OpenSLP, port 427 to deliver a new ransomware “ESXiArgs”. The ransomware encrypts files in affected ESXi servers and demand a ransom for file decryption. Learn More »

Common Vulnerabilities and Exposures

CVE-2021-21974
CVE-2020-3992

Background

October 20, 2020: VMWare released a patch and advisory for CVE-2020-3992. https://www.vmware.com/security/advisories/VMSA-2020-0023.html February 23, 2021: VMWare released a patch and advisory for CVE-2021-21974. https://www.vmware.com/security/advisories/VMSA-2021-0002.html

Threat Radar Overall Score:
CVSS Rating 9.0
FortiRecon Score 92/100
Known Exploited Yes
Exploit Prediction Score 87.96%
FortiGuard Telemetry 6

Latest Development

Recent news and incidents related to cybersecurity threats encompassing various events such as data breaches, cyber-attacks, security incidents, and vulnerabilities discovered.


February 03, 2023: CERT-FR posted an advisory for attack campaigns targeting vulnerable and unpatched VMware ESXi hypervisors with the aim of deploying ransomware. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-015/


FortiGuard Labs is aware of exploitation reported in the wild. Fortinet's customer remain protected by the IPS signatures released to detect and block any attack attempts related to the vulnerability (CVE-2021-21974, CVE-2020-3992) and has recently added Antivirus detections to block "ESXiArgs" ransomware attacks.

The attack is primarily targetting ESXi servers in version before 7.0 U3i, through the OpenSLP port (427). To check your version of ESXi, please refer to your server page in your customer interface and steps to disable SLP service. https://kb.vmware.com/s/article/7637

February 07, 2023: CISA Releases ESXiArgs Ransomware Recovery Script. https://www.cisa.gov/uscert/ncas/current-activity/2023/02/07/cisa-releases-esxiargs-ransomware-recovery-script

FortiGuard Cybersecurity Framework

Mitigate security threats and vulnerabilities by leveraging the range of FortiGuard Services.


PROTECT

  • Decoy VM

  • AV

  • AV (Pre-filter)

  • IPS

DETECT

  • Outbreak Detection

  • Threat Hunting

  • Content Update

RESPOND

  • Assisted Response Services

  • Automated Response

RECOVER

  • InfoSec Services

IDENTIFY

  • Attack Surface Monitoring (Inside & Outside)

Threat Intelligence

Information gathered from analyzing ongoing cybersecurity events including threat actors, their tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), malware and related vulnerabilities.


Loading ...

Indicators of compromise Indicators of compromise
IOC Indicator List
Indicator Type Status
80.82.77.139 ip Active
104.152.52.22 ip Active
104.152.52.24 ip Active
104.152.52.26 ip Active
193.163.125.138 ip Active
43.130.10.173 ip Active
193.37.255.114 ip Active
104.152.52.111 ip Active
104.152.52.149 ip Active
104.152.52.167 ip Active
104.152.52.110 ip Active
104.152.52.166 ip Active
104.152.52.133 ip Active
104.152.52.155 ip Active
104.152.52.168 ip Active
104.152.52.165 ip Active
104.152.52.164 ip Active
104.152.52.175 ip Active
104.152.52.195 ip Active
104.152.52.169 ip Active
104.152.52.172 ip Active
104.152.52.151 ip Active
104.152.52.138 ip Active
104.152.52.171 ip Active
104.152.52.189 ip Active
104.152.52.186 ip Active
104.152.52.194 ip Active
104.152.52.198 ip Active
104.152.52.127 ip Active
104.152.52.144 ip Active
104.152.52.101 ip Active
104.152.52.156 ip Active
104.152.52.174 ip Active
104.152.52.183 ip Active
104.152.52.108 ip Active
104.152.52.118 ip Active
104.152.52.170 ip Active
104.152.52.178 ip Active
104.152.52.114 ip Active
104.152.52.131 ip Active
104.152.52.124 ip Active
104.152.52.173 ip Active
104.152.52.251 ip Active
104.152.52.143 ip Active
185.165.190.34 ip Active
104.152.52.102 ip Active
104.152.52.18 ip Active
195.144.21.56 ip Active
104.152.52.217 ip Active
152.89.196.211 ip Active
104.152.52.236 ip Active
104.152.52.231 ip Active
104.152.52.205 ip Active
104.152.52.228 ip Active
104.152.52.206 ip Active
104.152.52.208 ip Active
104.152.52.241 ip Active
104.152.52.237 ip Active
104.152.52.224 ip Active
104.152.52.232 ip Active
104.152.52.234 ip Active
104.152.52.210 ip Active
104.152.52.240 ip Active
104.152.52.213 ip Active
104.152.52.85 ip Active
104.152.52.99 ip Active
104.152.52.242 ip Active
104.152.52.88 ip Active
773d147a031d8ef06ee8ec20b614a4fd9733668efeb2b05... file Active
104.152.52.72 ip Active
104.152.52.70 ip Active
10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0a... file Active
11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb5... file Active
5a9448964178a7ad3e8ac509c06762e418280c864c1d3c2... file Active
7f0ea6e4d18ac0c1051e7366c367b01c08e75afd17fc20d... file Active
104.152.52.27 ip Active
104.152.52.28 ip Active
104.152.52.29 ip Active
104.152.52.30 ip Active
104.152.52.31 ip Active
104.152.52.34 ip Active
104.152.52.35 ip Active
104.152.52.36 ip Active
104.152.52.37 ip Active
104.152.52.38 ip Active
104.152.52.40 ip Active
104.152.52.41 ip Active
104.152.52.42 ip Active
104.152.52.43 ip Active
104.152.52.44 ip Active
104.152.52.45 ip Active
104.152.52.46 ip Active
104.152.52.47 ip Active
104.152.52.48 ip Active
104.152.52.49 ip Active
104.152.52.50 ip Active
104.152.52.51 ip Active
104.152.52.52 ip Active
104.152.52.53 ip Active
104.152.52.54 ip Active