Security News > 2024 > July > Microsoft: Ransomware gangs exploit VMware ESXi auth bypass in attacks
Microsoft warned today that ransomware gangs are actively exploiting a VMware ESXi authentication bypass vulnerability in attacks.
Ransomware groups have focused on creating lockers dedicated to encrypting ESXi VMs rather than targeting specific ESXi vulnerabilities that would provide them a quicker way of acquiring and maintaining access to a victim's hypervisors.
The Play ransomware group is the latest such operation to start deploying an ESXi Linux locker in their attacks.
"The number of Microsoft Incident Response engagements that involved the targeting and impacting ESXi hypervisors have more than doubled in the last three years," Microsoft warned.
New Play ransomware Linux version targets VMware ESXi VMs. SEXi ransomware rebrands to APT INC, continues VMware ESXi attacks.
Linux version of RansomHub ransomware targets VMware ESXi VMs. Keytronic confirms data breach after ransomware gang leaks stolen files.
News URL
Related news
- SEXi ransomware rebrands to APT INC, continues VMware ESXi attacks (source)
- VMware ESXi auth bypass zero-day exploited by ransomware operators (CVE-2024-37085) (source)
- CISA warns of VMware ESXi bug exploited in ransomware attacks (source)
- Microsoft Says Ransomware Groups Are Exploiting the Newly-Patched VMware ESXi Flaw (source)
- Linux version of TargetCompany ransomware focuses on VMware ESXi (source)
- Linux version of RansomHub ransomware targets VMware ESXi VMs (source)
- New Attack Technique Exploits Microsoft Management Console Files (source)
- New Eldorado ransomware targets Windows, VMware ESXi VMs (source)
- Microsoft links Scattered Spider hackers to Qilin ransomware attacks (source)
- New Linux Variant of Play Ransomware Targeting VMWare ESXi Systems (source)