Anyone who thought ransomware was losing ground was wrong: the battle has moved to the next level

In February 2021, CrowdStrike reported that the attacker groups CARBON SPIDER and SPRITE SPIDER had started attacking Linux systems too, including servers running the VMware ESXi hypervisor, the most widespread virtualization platform in companies. For attackers, the method is far more efficient: a single compromised host means all the virtual machines get encrypted at once. Since then, this tactic has become commonplace.

How does ransomware attack ESXi servers?

As you probably know, ransomware attacks companies’ infrastructure and encrypts the data on infected computers and servers. To recover it, the attackers demand a ransom, usually a fairly large one.

For a long time, these groups targeted Windows computers and servers, which are easier to compromise. However, starting in the second half of 2020, the SPRITE SPIDER and CARBON SPIDER groups began attacking Linux systems too, including ESXi servers. The attackers adapted their ransomware, Defray777 and DarkSide, to run on ESXi. DarkSide became known worldwide in May 2021, after the attack on Colonial Pipeline in the US.

The real problem is that this malware attacks virtualization environments and compromises practically all the virtual machines running on them, to make the damage to the company as great as possible.

The attackers use vCenter (vSphere) credentials saved in browsers, or use various methods to steal those kept in memory. If they succeed, they reset the root password and enable the SSH service, so they can connect remotely to the management console of the virtual machines.

Compromising the host that runs all the virtual machines amounts to compromising all of them, only faster and more efficiently. For technical details, read the analysis on the CrowdStrike blog.

When we talk about security, we need to establish one thing from the outset: an infrastructure is only as secure as the least secure workstation on the network.

What has happened since?

Attacks on ESXi servers have become common practice for ransomware groups:

• In February 2023, the ESXiArgs campaign encrypted thousands of internet-facing ESXi servers through an old vulnerability (CVE-2021-21974) that VMware had patched back in 2021. The servers that fell were the unpatched ones.
• In July 2024, Microsoft announced that several ransomware groups were exploiting a vulnerability in ESXi (CVE-2024-37085) that let an attacker with rights in Active Directory gain full control over domain-joined ESXi servers.
• Many well-known ransomware families now also have variants for Linux and ESXi.

How do we secure the infrastructure against ransomware?

Adopting solid security measures reduces the risk of the infrastructure being compromised by ransomware. Here are a few recommendations:

• updating the systems on all of the company’s computers and servers, including hypervisors (ESXi, Hyper-V) and network equipment;
• antivirus and antimalware solutions on all computers and servers, preferably EDR solutions, which recognize suspicious behavior;
• a hardware firewall that filters traffic and secures the network;
• long, unique passwords, plus two-step verification (MFA), especially for administrator accounts; a password is changed as soon as there are signs it has been compromised;
• effective backup policies, with an offline or immutable copy that attackers can’t encrypt, and with tested restores;
• encrypted VPN connections with two-step verification for remote access to company resources.

For virtualized environments, in addition:

• the management interfaces (vCenter, ESXi) aren’t exposed to the internet and are accessible only from a separate management network;
• the SSH service on ESXi stays off and is turned on only when needed;
• admin passwords aren’t saved in the browser;
• virtualization admin accounts are kept separate from regular domain accounts.

See also 5 reasons why ransomware can’t be stopped easily and the response plan for a cyberattack.

RezolvIT is an IT outsourcing company that supports the companies it works with, whether it’s about IT security and IT infrastructure or about employees working from home.