The US Cyber Security and Infrastructure Agency (CISA) and the Federal Bureau of Investigation (FBI) released this week a recovery guide for the ESXiArgs ransomware, which has harmed thousands of companies globally.
This was because malicious attackers were allegedly taking advantage of known vulnerabilities in unpatched, out-of-service or outdated versions of VMware ESXi software. Through these “loopholes” they would be deploying ESXiArgs ransomware on ESX servers, rendering these devices unusable.
The recovery tool can be found at this link and has been used by numerous corporations, who managed to recover encrypted items without paying a ransom to attackers.
However, CISA warns that to use this resource, it is essential to understand how it works. In this sense, companies harmed by ESXiArgs should evaluate the recommendations present in the README file, which comes with the script.
The number of servers infected by ESXiArgs in several countries has already exceeded 3 thousand. According to the victims, in order to decrypt the data, the hackers requested about 2 Bitcoins, which is equivalent to approximately US$ 22,800 (as of the present moment).
In addition, malicious attackers would have demanded payment of the ransom within three days, as a condition for not disclosing the organizations’ sensitive data.
As per Rapid 7, ESXiArgs attempted to shut down virtual machines by killing a process in the virtual machine’s kernel that handles I/O commands, however, in some cases it was unsuccessful as organizations were able to recover their data.
The recovery script developed by CISA in conjunction with the FBI is based on the work of researchers Enes Sonmez and Ahmet Aykac, and shows how victims can rebuild virtual machine metadata from disks that the malware was unable to encrypt.
In practice, the function of the script is to create new configuration files that allow access to the VMs and not delete encrypted files. However, CISA makes no guarantees that the script is secure.
VMware recommends that companies implement the patch released in 2021 for the vulnerability exploited by ESXiArgs. Organizations that do not fix the flaw should temporarily disable the ESXi Service Location Protocol (SLP) or still keep port 427 disabled.
About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Senhasegura
Senhasegura strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.
