CISA thinks it has a fix to the global ESXi ransomware attacks
Script to target attacks released on GitHub
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a script on GitHub aimed at helping the VMware ESXiransomwareattack victims rebuild their endpoints.
Thousands of VMware ESXi servers have recently been targeted across Europe and North America, with initial reports mentioning some 500 victims, and newer assessments putting the number at 2,800.
The unnamed attackers scanned VMware ESXi servers in search of CVE-2021-21974, a known vulnerability that was patched by the company two years ago. Those that were vulnerable ended up infected with ransomware.
Failed encryption campaign
However, the cybercrime campaign seems to have been mostly unsuccessful, as the ransomware did not encrypt flat files which hold data for virtual disks.
Two researchers from YoreGroup Tech Team found a way to use those files to rebuild virtual machines. While many were successful in using their method to recover their servers, the process is allegedly relatively complex, prompting CISA to jump in and help automate the process with a script.
Widespread cyberattack hits servers across Europe>What is ransomware and how does it work?>These are the best endpoint protection services around
“CISA is aware that some organizations have reported success in recovering files without paying ransoms. CISA compiled this tool based on publicly available resources, including a tutorial by Enes Sonmez and Ahmet Aykac,” the agency said. “This tool works by reconstructing virtual machine metadata from virtual disks that were not encrypted by the malware.”
While immensely helpful, the script still needs to be carefully considered, CISA says. Administrators should first review it, to eliminate any possible complications. Backing up the files before engaging in any recovery process is also highly welcome.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
“While CISA works to ensure that scripts like this one are safe and effective, this script is delivered without warranty, either implicit or explicit.” the agency concluded. “Do not use this script without understanding how it may affect your system. CISA does not assume liability for damage caused by this script.”
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
New fanless cooling technology enhances energy efficiency for AI workloads by achieving a 90% reduction in cooling power consumption
