IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Hackers encrypt virtual hard disks using two VMWare ESXi vulnerabilities

Hypervisor flaws enable hackers to send requests to devices and take control

VMWare building with arched glass front

Security researchers have warned of two VMWare ESXi hypervisor flaws that ransomware gangs are using to encrypt virtual hard drives.

The vulnerabilities, CVE-2019-5544 and CVE-2020-3992, exist in the ESXi hypervisor that enables multiple virtual machines (VMs) to share the same storage hardware. The flaws affect the Service Layer Protocol (SLP), which allows computers and other devices to find services in a local area network without prior configuration.

According to reports, hackers have exploited the flaws to send malicious SLP requests to an ESXi device and take it over. Cyber criminals behind the RansomExx ransomware have been launching attacks since October 2020.

The cyber criminals gained access to devices on corporate networks and are using this as a springboard to attack other ESXi VMs and encrypt virtual hard drives.

According to a Reddit post, hackers have encrypted 1,000 VMs at Brazil’s Superior Tribunal de Justica (Brazil’s equivalent of the Supreme Court). Other victims have had VMs shut down and datastores encrypted and left with a ransom note at the datastore level.

Such attacks have been confirmed by security researcher Kevin Beaumont, who said hackers have used these vulnerabilities to bypass Windows security to shut down VMs and encrypt VMDKs directly on the hypervisor.

Currently, security researchers have only observed the RansomExx crime group abusing these flaws. However, researchers also believe the criminals behind the Babuk Locker ransomware have deployed similar tactics. 

According to cyber security firm Kela, other cyber criminals have been selling access to ESXi instances on underground forums for thousands of dollars, which could explain the link between the ESXi flaws and the ransomware attacks using them.

System administrators have been urged to update their VMWare ESXi installs or disable SLP support to secure them.

Natalie Page, cyber threat intelligence analyst at Sy4 Security, told ITPro that VMWare is a lucrative platform for attackers to target due to its global prevalence.

“Luckily the recommendations in this instance are pretty straight forward, users of VMWare ESXi should prioritize implementing patches for both CVE-2019-5544 and CVE-2020-3992 or disable SLP support to prevent attacks if the protocol isn't needed,” Page said.

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Broadcom reportedly looking at acquiring cloud company VMware
mergers and acquisitions

Broadcom reportedly looking at acquiring cloud company VMware

23 May 2022
US security agency issues emergency alert over vulnerable VMware products
Security

US security agency issues emergency alert over vulnerable VMware products

19 May 2022
Unlocking the value of data with data innovation acceleration
Whitepaper

Unlocking the value of data with data innovation acceleration

12 May 2022
Protect and preserve your data from endpoint to infrastructure
Whitepaper

Protect and preserve your data from endpoint to infrastructure

12 May 2022

Most Popular

Open source packages with millions of installs hacked to harvest AWS credentials
hacking

Open source packages with millions of installs hacked to harvest AWS credentials

24 May 2022
Europe's first autonomous petrol station opens in Lisbon
automation

Europe's first autonomous petrol station opens in Lisbon

23 May 2022
Nvidia pauses hiring to help cope with inflation
Careers & training

Nvidia pauses hiring to help cope with inflation

23 May 2022