#esxiargs — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #esxiargs, aggregated by home.social.
-
😬 Vous avez aimé la campagne de #cyberattaques avec le #ransomware dit #ESXiArgs ? Espérons que cela serve de gros coup de tocsin 🔔
Parce que la menace qui pèse sur les environnements virtualisés ne se limite pas à cet exemple, loin s'en faut. Faisons le point sur les différentes franchises qui s'attaquent à #ESXi. 🔽
Spoiler: elles sont nombreuses.
https://www.lemagit.fr/conseil/Ce-que-lon-sait-des-rancongiciels-pour-VMware-ESXi -
If you're planning on running a single hosted baremetal ESXi server on the internet and want to avoid being caught by the next ESXiArgs, here’s a quick how-to:
https://infrageeks.com/post/2023-02-22.how-to-safely-run-esxi-on-the-internet/
https://infrageeks.com/post/2023-02-23.how-to-safely-run-esxi-on-the-internet-part-2/
-
ESXiArgs Ransomware Hits Over 500 New Targets in European Countries
https://thehackernews.com/2023/02/esxiargs-ransomware-hits-over-500-new.html #Malware #Ransomware #ESXiArgs -
There is a new ESXIArgs encryption routine that is out now to prevent the decryption from the tool CISA released. Update and get your hypervisors off the internet!
#security #cisa #esxiargs #encryption -
This week's newsletter is hot off the press, get it here: https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-b16
The #ESXiArgs escapades have gone from bad to okay and back to bad again, after attackers revised their encryption routine to bypass CISA's recovery script, and launched a 2nd wave of attacks that resulted in the reinfection of hundreds of hosts. Worst yet - we don't know how they're doing it, as the OpenSLP service (believed to be their method of ingress) has been disabled in a number of reported infections.
PowerShell isn't dead - The DFIR Report published their analysis of an apparent attack by Iran's Oilrig/APT34, whose initial infection relied exclusively on PowerShell and remained undetected for a significant period of time.
Proofpoint have unveiled #TA866, a savvy threat group that leverages the 404 Traffic Distribution System and little known AutoHotKey scripting language to cherry pick their targets.
#RedTeam members might find the BokuLoader Reflective Loader for #CobaltStrike useful in their next engagements, as well as #LocalPotato - the latest PrivEsc technique to join the Potato family.
#BlueTeam - check out a list of resources that popped up last week to help analyse #ASyncRAT malware and infections, as well as some helpful how-tos on hunting IIS backdoors and DLL abuse techniques
Happy reading, and happy Monday!
https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-b16
#infosec #CyberAttack #Hacked #cyber #news #cybernews #infosecnews #informationsecurity #cybersecurity #hacking #security #technology #hacker #vulnerability #vulnerabilities #malware #ransomware #dfir #redteam #soc #threatintel #threatintelligence #vmware #ESXi
-
VMware ESXi is in the news thanks to ESXiArgs, a strain of ransomware affecting a two year old overflow issue in the OpenSLP service. The best course of action is patching your ESXi servers as soon as possible. Our latest blog post covers the vulnerability and includes a prebuilt query to help you zero in on ESXi servers.
Check out the link below for more!
-
We've been tracking the #ESXiArgs #ransomware for the last few days, here's what we've seen so far :
🔎 We’ve observed a new variant of ESXiArgs emerge over the last 24 hours. Key updates to this version include:
➡️ A new ransom note with no #BTC addresses–making it more difficult for researchers to track payments
➡️ Encryption of additional data, rendering existing decryption tools ineffective🔎 In the last few days, we’ve seen just over 3,800 unique hosts compromised, and 1,800 which are online currently. Over the last 24 hours, just over 900 hosts have upgraded to the latest ransomware variant.
🔎 As we reported yesterday, OpenSLP does not appear to be the method of attack, given that multiple compromised hosts did not have SLP running.
-
Nice #GreyNoise article on finding #ESXiArgs attacks as well as stats.
https://www.greynoise.io/blog/exploit-vector-analysis-of-emerging-esxiargs-ransomware -
The #ESXiArgs mass VMware ransomware attack has notable characteristics: 1) It's automated 2) Apparently no exfiltration 3) No leak site by the group 4) Some repeated bitcoin addresses 5) Re-use of Babuk code (with changes) plus more. Some observations from Intel 471. (Caution! This is rapidly moving story, and @BleepingComputer has some of the latest developments)
https://intel471.com/blog/an-analysis-of-the-vmware-esxi-ransomware-blitz #infosec -
New #ESXiArgs #ransomware version prevents VMware ESXi recovery <-- Via Pythagoras Abrams aka @lawrenceabrams
-
CSI and FBI release #ESXiArgs Ransomware Recovery Guidelines: https://www.cisa.gov/uscert/ncas/current-activity/2023/02/08/cisa-and-fbi-release-esxiargs-ransomware-recovery-guidance
#Hacking #ThreatIntelligence #RansomwareUpdate #RansomwareAttack #Remediation
-
In case you didn't catch our new blog post yesterday: We have uploaded our #Yara rules for #ESXiArgs #Ransomware to @abuse_ch's Yaraify to make them more accessible 👍 Happy hunting 🔍
https://yaraify.abuse.ch/yarahub/rule/RANSOM_ESXiArgs_Ransomware_Encryptor_Feb23/
https://yaraify.abuse.ch/yarahub/rule/RANSOM_ESXiArgs_Ransomware_Python_Feb23/
https://yaraify.abuse.ch/yarahub/rule/RANSOM_ESXiArgs_Ransomware_Bash_Feb23/ -
Inzwischen hat die US-Behörde CISA ein Skript veröffentlicht, das Systeme, die im Rahmen der #ESXiArgs-Angriffe verschlüsselt wurden, in einigen Fällen wiederherstellen kann. Das Tool basiert auf den Erkenntnissen verschiedener Quellen.
👉 https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2023/2023-205338-1032.html
#DeutschlandDigitalSicherBSI -
"CISA releases recovery script for ESXiArgs ransomware victims"
"CISA compiled this tool based on publicly available resources, including a tutorial by Enes Sonmez and Ahmet Aykac."
-
🚨 #RansomwareUpdate #ESXiArgs #Ransomware🚨
If you're looking for #IOCs on that new #VMware ransomware, here's the deets https://blogs.blackberry.com/en/2023/02/esxiargs-ransomware-knocking-out-unpatched-vmware-esxi-linux-servers-worldwide -
Digital infrastructure requires maintenance, yet when we purchase technology we don't budget for or consider what that requires. Update the IRS system from the 80s for $10 billion? Approved. Spend $100 million/year to keep it running smoothly? Nope. Deploy virtualization infrastructure to better utilize hardware spend? Approved. Spend money to ensure high availability and maintainability, including effective redundant backups? Nawwww, we got our cost savings, don't ruin it for us. #ESXiArgs 😩
-
#ESXiArgs #Ransomware: Knocking Out Unpatched #VMware ESXi #Linux Servers Worldwide
-
Vulnerability management in hypervisors is a Grade-A dumpster fire and has been for years. Anyone who has had to patch hypervisors understands why they often lag behind in patching. Sure, patching is the responsibility of the organization using a tool. But the harder it is to patch something, the less likely it is that patching will occur.
I'm personally hoping the #ESXiArgs ransomware operations change how hypervisor vendors provide patches and remediations, specifically lowering friction for systems admins that have to apply the patches.
-
Un petit #writeup des événements des derniers jours, ça vous tente ?
🚨 Tout ce que vous voulez savoir, sans trop oser le demander, sur la vaste campagne de #cyberattaques déclenchée en fin de semaine dernière contre les serveurs #VMware #ESXi est ici, juste après le clic.
(et je me demande quand même si l'objectif était réellement de ramasser des cryptopépettes comme avec les autres #ransomware 🤔 ) #ESXiArgs (not #Nevada)
https://www.lemagit.fr/actualites/365530070/La-vaste-cyberattaque-contre-les-serveurs-VMware-ESXi-fait-des-milliers-de-victimes