Security News > 2024 > July > Microsoft: Ransomware gangs exploit VMware ESXi auth bypass in attacks
Microsoft warned today that ransomware gangs are actively exploiting a VMware ESXi authentication bypass vulnerability in attacks.
Ransomware groups have focused on creating lockers dedicated to encrypting ESXi VMs rather than targeting specific ESXi vulnerabilities that would provide them a quicker way of acquiring and maintaining access to a victim's hypervisors.
The Play ransomware group is the latest such operation to start deploying an ESXi Linux locker in their attacks.
"The number of Microsoft Incident Response engagements that involved the targeting and impacting ESXi hypervisors have more than doubled in the last three years," Microsoft warned.
New Play ransomware Linux version targets VMware ESXi VMs. SEXi ransomware rebrands to APT INC, continues VMware ESXi attacks.
Linux version of RansomHub ransomware targets VMware ESXi VMs. Keytronic confirms data breach after ransomware gang leaks stolen files.
News URL
Related news
- Over 37,000 VMware ESXi servers vulnerable to ongoing attacks (source)
- New SuperBlack ransomware exploits Fortinet auth bypass flaws (source)
- Toronto Zoo shares update on last year's ransomware attack (source)
- Ransomware gang encrypted network from a webcam to bypass EDR (source)
- Ransomware gang encrypted network from a webcam to bypass EDR (source)
- Microsoft: North Korean hackers join Qilin ransomware gang (source)
- Defending against EDR bypass attacks (source)
- Ransomware gang creates tool to automate VPN brute-force attacks (source)
- SANS Institute Warns of Novel Cloud-Native Ransomware Attacks (source)
- ⚡ THN Weekly Recap: Router Hacks, PyPI Attacks, New Ransomware Decryptor, and More (source)