cyber.hendryadrian.com
Vulnerability & Exploit · wiz.io

ESXiArgs Ransomware Attacks Exploit VMware ESXi Vulnerability CVE-2021-21974

· Original article ↗

Summary

Researchers reported ESXiArgs ransomware attacks exploiting CVE-2021-21974 in exposed VMware ESXi servers. The article outlines affected versions, observed malware behavior, available recovery tools, and patching or OpenSLP-disabling steps.

Key points

  • Attacks observed from February 3, 2023, targeted VMware ESXi versions 6.5, 6.7, and 7.0 using CVE-2021-21974 in OpenSLP on port 427.
  • The heap overflow can enable remote code execution when an attacker can reach the service; a patch has been available since February 23, 2021.
  • Wiz reported that 12% of ESXi servers in its data were unpatched and vulnerable. Attacks were reported worldwide, mostly in Europe.
  • The malware encrypts virtual-machine files and attempts to stop VMX processes; researchers said further analysis might indicate it is a Babuk variant, after initially associating it with Nevada ransomware.
  • Researchers published a tool to assist with decryption, and CISA released a tool to attempt recovery of affected virtual machines.
  • Security teams are advised to patch CVE-2021-21974 or disable OpenSLP using the listed commands.

Article Details

Vulnerability Types
  • Heap overflow in OpenSLP
Affected Versions
  • VMware ESXi 7.x before ESXi70U1c-17325551
  • VMware ESXi 6.7.x before ESXi670-202102401-SG
  • VMware ESXi 6.5.x before ESXi650-202102101-SG
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Disable the OpenSLP service.

Indicators of compromise

TypeIndicatorContext
IPV4104[.]152[.]52[.]55Observed attempting to exploit CVE-2021-21974.
IPV4152[.]89[.]196[.]211Observed attempting to exploit CVE-2021-21974.
IPV4185[.]142[.]236[.]34Observed attempting to exploit CVE-2021-21974.
IPV4185[.]142[.]236[.]35Observed attempting to exploit CVE-2021-21974.
IPV4185[.]142[.]236[.]36Observed attempting to exploit CVE-2021-21974.
IPV4185[.]165[.]190[.]17Observed attempting to exploit CVE-2021-21974.
IPV4185[.]165[.]190[.]34Observed attempting to exploit CVE-2021-21974.
IPV4193[.]163[.]125[.]138Observed attempting to exploit CVE-2021-21974.
IPV4193[.]37[.]255[.]114Observed attempting to exploit CVE-2021-21974.
IPV4195[.]144[.]21[.]56Observed attempting to exploit CVE-2021-21974.
IPV443[.]130[.]10[.]173Observed attempting to exploit CVE-2021-21974.
IPV471[.]6[.]135[.]131Observed attempting to exploit CVE-2021-21974.
IPV471[.]6[.]199[.]23Observed attempting to exploit CVE-2021-21974.
IPV480[.]82[.]77[.]139Observed attempting to exploit CVE-2021-21974.
IPV480[.]82[.]77[.]33Observed attempting to exploit CVE-2021-21974.
IPV489[.]248[.]167[.]131Observed attempting to exploit CVE-2021-21974.
IPV493[.]174[.]95[.]106Observed attempting to exploit CVE-2021-21974.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe activity exploits CVE-2021-21974, a remotely exploitable OpenSLP heap overflow, on internet-accessible ESXi servers.T1486 · Data Encrypted for ImpactESXiArgs encrypts virtual-machine files, including .vmdk and .vmx files, using a public key deployed by the malware.T1565 · Data ManipulationThe malware creates an argsfile containing arguments passed to the encryption binary, including encryption block and file-size parameters.

CVE

CVE-2021-21974Vmware · Cloud foundation; Vmware · EsxiThese recent attacks, dubbed ESXiArgs, leverage CVE-2021-21974, a vulnerability which impacts the Service Location Protocol (SLP) service and grants an attacker the ability to execute arbitrary code remotely. A patch

People

Habib KaratasResearcher whose Twitter thread is listed as a reference.

Malware

Babukthreat actors. As of February 8, further analysis could indicate the malware might be a variant of the Babuk ransomware. Babuk source code was leaked in 2021 and utilized in previous ESXi ransomware attacks, such asCheersCryptBabuk source code was leaked in 2021 and utilized in previous ESXi ransomware attacks, such as CheersCrypt and PrideLocker encryptor from the Quantum/Dagon group.ESXiArgsThese recent attacks, dubbed ESXiArgs, leverage CVE-2021-21974, a vulnerability which impacts the Service Location Protocol (SLP) service and grants an attacker the ability to execute arbitrary code remotely. A patchNevadaResearchers previously believed the malware, ESXiArgs, is an instance of the Nevada ransomware family, which was first observed in December 2022 and associated with Chinese and Russian threat actors. As of February 8,PrideLockercode was leaked in 2021 and utilized in previous ESXi ransomware attacks, such as CheersCrypt and PrideLocker encryptor from the Quantum/Dagon group.

Vendors

VMwareOn February 3rd, 2023, researchers began observing attacks aimed at the VMware ESXi hypervisor with the goal of infecting them with ransomware. The affected systems are ESXi hypervisors version 6.5, 6.7 and 7.0. 

Products

ESXiOn February 3rd, 2023, researchers began observing attacks aimed at the VMware ESXi hypervisor with the goal of infecting them with ransomware. The affected systems are ESXi hypervisors version 6.5, 6.7 and 7.0. OpenSLPCVE-2021-21974 is a heap overflow vulnerability in OpenSLP, a network service that listens on TCP and UDP port 427 on default installations of VMware ESXi. A malicious actor that has access to port 427 could exploit the

Related Articles