Context over chaos. Disconnected technologies, siloed data, and reactive processes can only get you so far. Protecting businesses in today’s threat landscape demands more than a set of security tools – it requires context.
That's where Avertium comes in
Security. It’s in our DNA. It’s elemental, foundational. Something that an always-on, everything’s-IoT-connected world depends on.
Helping mid-to-enterprise organizations protect assets and manage risk is our only business. Our mission is to make our customers’ world a safer place so that they may thrive in an always-on, connected world.
Best-in-class technology from our partners... backed by service excellence from Avertium.
Interested in becoming a partner?
With Avertium's deal registration, partners can efficiently and confidently connect with Avertium on opportunities to protect your deals.
Microsoft Copilot for Security analyzes and synthesizes high volumes of security data which can help healthcare cybersecurity teams do more with less.
Dive into our resource hub and explore top
cybersecurity topics along with what we do
and what we can do for you.
overview
Over the weekend, ESXiArgs ransomware hit VMware servers and encrypted thousands of unpatched internet exposed ESXi systems. Threat actors are actively exploiting a two-year old remote code execution vulnerability (CVE-2021-21974), allowing them to execute remote commands on unpatched VMware ESXi servers via their OpenSLP service (port 427).
CVE-2021-21974 was patched in February 2021, but there are current attack campaigns going after unpatched systems. Once the threat actor gains access, the vulnerability allows them to encrypt files on the ESXi server and leave a ransom note. The ransomware note asks for $50,000 bitcoin for decryption. Current impacted systems are ESXi hypervisors in version 7.0 U3i and prior.
More than 3,200 servers are encrypted, and more than a third of those servers are hosted in France. Security researcher Kevin Beaumont stated that many cloud providers offer managed VMware hosting, yet they have not been patching, leaving all ports open to the internet on management IPs.
Organizations running VMware are advised to patch ESXi servers and upgrade to an unaffected version, such as v8, or disable the OpenSLP service immediately. VMware’s advisory states that the possibility of exploitation of CVE-2021-21974 can be removed by performing the steps detailed in the resolution section of their advisory.
As previously stated, Avertium advises to patch to ESXi servers and upgrade to an unaffected version, such as v8. You may find guidance here.
CVE-2021-21974 impacts the following systems:
At this time, there are no known IoCs associated with CVE-2021-21974. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.
How to Disable/Enable the SLP Service on VMware ESXi (76372)
Risky Biz News: Ransomware wave hits thousands of VMWare ESXi servers (substack.com)
Massive ESXiArgs ransomware attack targets VMware ESXi servers worldwide (bleepingcomputer.com)