Ransomware Attacks Targeting VMware ESXi Infrastructure Adopt New Pattern

Cybersecurity professionals at Sygnia have noted a notable change in the strategies used by ransomware groups that are aiming at virtualized environments, specifically VMware ESXi infrastructure, in relation to development.

The incident response team has noted a steady increase in these attacks, with threat actors exploiting misconfigurations and vulnerabilities in virtualization platforms to maximize their impact.

Sygnia’s analysis reveals that notorious ransomware groups such as LockBit, HelloKitty, BlackMatter, RedAlert (N13V), Scattered Spider, Akira, Cactus, BlackCat, and Cheerscrypt frequently leverage this attack vector.

These threat actors have adopted a new attack pattern, focusing on data exfiltration before encrypting the targeted systems.

The modus operandi of these ransomware attacks involves gaining initial access to the virtualized environment, escalating privileges, and conducting extensive reconnaissance to identify valuable data.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

The threat actors then exfiltrate this data, enabling them to encrypt the existing files and release the stolen information publicly to inflict additional reputational damage on the targeted organizations.

One of the most alarming aspects of these attacks is the unique actions taken by the threat actors during the ransomware execution phase.

Sygnia’s investigations have revealed that the attackers shut down all virtual machines before initiating the encryption process, targeting the ‘/vmfs/volumes’ folder of the ESXi filesystem. This tactic ensures maximum disruption and makes recovery efforts more challenging for the victims.

This includes regularly patching and updating virtualization infrastructure, enforcing strong access controls, monitoring suspicious activities, and having a robust incident response plan in place.

A ransomware attack on ESXi infrastructure can be catastrophic, with extensive data loss, operational disruption, financial damage, data theft, and legal and reputational harm that can threaten an organization’s very survival.

 The key attack vectors are unpatched vulnerabilities, misconfigurations, phishing, compromised credentials, and insecure workloads.

Organizations must adopt a multi-layered security approach, including timely patching, hardening, network segmentation, strong authentication, and workload protection, to mitigate the risk of ransomware compromising their ESXi infrastructure.

As ransomware groups continue to adapt their tactics, it is crucial for organizations relying on virtualized environments to remain vigilant and proactive in their cybersecurity efforts.

By staying informed about the latest threats and implementing effective defense strategies, businesses can better protect their critical assets and minimize the risk of falling victim to these devastating attacks.

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service