Article
RedAlert: The New Ransomware Targeting VMware ESXi Servers
RedAlert (N13V) ransomware targets VMware ESXi servers on Windows and Linux, shuts down virtual machines, demands Monero and runs a leak site.
Read more
Significant cyber incident
ESXiArgs ransomware campaign against VMware ESXi servers
In early February 2023 a ransomware campaign hit VMware ESXi servers that were exposed to the internet and not patched.
In short
In early February 2023 a ransomware campaign hit VMware ESXi servers that were exposed to the internet and not patched. Italy's national cybersecurity agency (ACN) reported a few thousand compromised servers worldwide, with France the most affected and dozens of organizations in Italy. US agencies later counted over 3,800 servers. The flaw had been fixed by the vendor in February 2021, two years earlier.
What happened
On 5 February 2023 the Italian national cybersecurity agency ACN said its CSIRT Italia had detected a massive attack using ransomware already in circulation, aimed at VMware ESXi servers. ESXi is software that lets one physical server run many virtual machines. ACN said the flaw used had been fixed by the vendor long before, but not everyone who ran affected systems had applied the fix.
ACN said organizations in France were the first to notice, probably because of many infections at some providers there. The wave then moved to other countries including Italy. ACN put the number of compromised servers at a few thousand worldwide, with France the most affected, followed by countries such as Finland and Italy, and also Canada and the United States.
In Italy, dozens of organizations had found malicious activity against them, and ACN expected the number to grow. ACN identified several dozen Italian systems as probably compromised and warned many others that were exposed but not yet compromised. ACN does not name the Italian victims.
On 8 February 2023 CISA and the FBI published advisory AA23-039A on the same campaign, which they call ESXiArgs, and said the actors had compromised over 3,800 servers globally.
Timeline
-
24 February 2021
CSIRT Italia alert AL03/210224 lists CVE-2021-21974, an OpenSLP flaw in ESXi, and advises patching.
-
February 2021
The vendor fixes CVE-2021-21974 (ACN).
-
Weekend of 4 to 5 February 2023
Attacks grow sharply, first noticed in France and then in other countries including Italy.
-
4 February 2023
CSIRT Italia publishes a bulletin on its public portal with steps to fix the flaw.
-
5 February 2023
ACN issues a press release on the massive ransomware attack against ESXi servers.
-
6 February 2023
ACN publishes the news on its website with the press release and the CSIRT Italia bulletin.
-
7 February 2023
CISA releases a recovery script for ESXiArgs victims.
-
8 February 2023
CISA and the FBI publish advisory AA23-039A with recovery guidance.
How the attack worked
The sources describe a short chain that relies on servers that had not been patched. CISA and the FBI say the actors were likely targeting end-of-life ESXi servers or servers without the available patches. ACN names the flaw CVE-2021-21974.
Step 1: find exposed ESXi servers
ACN says the flaw affects ESXi virtualisation systems exposed on the internet. CVE-2021-21974 is a heap buffer overflow in the OpenSLP component of ESXi that could allow arbitrary command execution, according to CSIRT Italia’s alert of 24 February 2021.
Step 2: run the exploit and deploy ransomware
The attackers used the flaw to deploy ransomware on servers that had no fix. ACN says other vulnerabilities might also be used. CISA and the FBI say they saw no evidence that the actors had established persistence.
Step 3: encrypt configuration files
CISA and the FBI say the ransomware encrypts configuration files on ESXi servers, which can make virtual machines unusable. It does not encrypt flat files, so in some cases victims can rebuild the configuration files with the recovery script.
- Exposed serverAn ESXi server open to the internet with no fix for CVE-2021-21974
- ExploitThe flaw is used to run commands on the serverTechnique T1190 (MITRE ATT&CK, opens in a new tab)
- RansomwareConfiguration files of virtual machines are encryptedTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- Ransom demandSystems are unusable until a ransom is paid
- RecoveryVictims may rebuild files with the CISA script, since flat files are not encrypted
ATT&CK techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
Who says who was behind it
No actor has been named in the sources opened. ACN described the ransomware as already in circulation, and CISA and the FBI call the actors "ESXiArgs actors" without attributing them to a named group or state.
Impact
Scale: ACN reported a few thousand compromised servers worldwide on 5 February 2023, with France the most affected. CISA and the FBI later counted over 3,800 servers globally.
Italy: dozens of organizations in Italy found malicious activity against them, and ACN identified several dozen Italian systems as probably compromised. ACN does not say which organizations or sectors.
Effect: configuration files on ESXi servers were encrypted, which can make virtual machines unusable until files are rebuilt or a ransom is paid.
Data: the sources opened do not report data theft.
Government and regulator response
- 4 February 2023: CSIRT Italia published a bulletin on its portal with the procedure to fix the vulnerability.
- 5 and 6 February 2023: ACN issued its press release and urged all owners of vulnerable systems to update. It said it alerted organizations whose exposed systems were not yet compromised.
- 7 February 2023: CISA released a recovery script for victims.
- 8 February 2023: CISA and the FBI published advisory AA23-039A, advising updates, disabling SLP and not exposing ESXi to the internet.
Lessons
-
Patch known flaws
The flaw was fixed in February 2021 and exploited in February 2023. Two years was enough for attackers to find unpatched systems.
-
Keep management interfaces off the internet
ACN and CISA both say the problem concerns servers exposed to the internet. Do not expose the hypervisor.
-
Disable services you do not use
CISA and the FBI advise disabling the SLP service on ESXi.
-
Replace end-of-life software
CISA and the FBI say the actors targeted end-of-life or unpatched ESXi servers.
-
Know who owns your exposed systems
ACN could not trace the owner of some exposed systems, which delayed warnings.
-
Keep a recovery plan
Because flat files were not encrypted, some victims could rebuild their machines. Offline backups give a firmer path.
What to check in your own organization
-
Inventory
List every ESXi host and its version, and who owns it.
-
Exposure
Check that no ESXi management or SLP service is reachable from the internet.
-
Patch level
Confirm CVE-2021-21974 and later ESXi fixes are applied; replace end-of-life versions.
-
SLP
Disable the Service Location Protocol service where it is not needed.
-
Logging
Review network logs to and from ESXi hosts for unusual scanning.
-
Backups
Keep offline backups of virtual machines and test a restore.
-
Contacts
Know how to reach CSIRT Italia or your national CERT during an incident.
Where it happened
Questions
What was ESXiArgs?
A ransomware campaign in February 2023 that encrypted configuration files on unpatched, internet-exposed VMware ESXi servers.
How many servers were hit?
ACN said a few thousand worldwide on 5 February 2023. CISA and the FBI later said over 3,800.
Was Italy affected?
Yes. ACN said dozens of organizations in Italy found malicious activity, and it identified several dozen Italian systems as probably compromised.
Which flaw was used?
ACN names CVE-2021-21974, fixed by the vendor in February 2021.
Who was behind it?
The sources opened name no actor.
Can victims recover?
CISA released a script on 7 February 2023. It works in some cases because the ransomware does not encrypt flat files.
In our research
Sources
- Registrato un massiccio attacco ransomware tramite infezione di sistemi VMware (press release, 5 February 2023) ACN
- Rilevato lo sfruttamento massivo della CVE-2021-21974 in VMware ESXi (6 February 2023) ACN
- Vulnerabilità su prodotti VMware (AL03/210224/CSIRT-ITA) CSIRT Italia, ACN
- ESXiArgs Ransomware Virtual Machine Recovery Guidance (AA23-039A) CISA and FBI
- CISA Releases ESXiArgs Ransomware Recovery Script (7 February 2023) CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.