Ransomware is Targeting the ESXi Hypervisor, the Reddit Breach was Caused By Employee Credential
Phishing, and this new Ransomware is Targeting Linux!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for February 14, 2023 - Happy Valentines Day!
- this is your summary of the threats to our security, privacy and Internet freedom!
Let’s jump right into the news this week.
VMWare ESXi is a hypervisor for cloud hosts and enterprises.
It runs using it’s own OS on server hardware and basically acts as a consolidator for hardware
resources.
This is a type 1 hypervisor, while a type 2 could be defined as VirtualBox, which runs
as an app inside another OS.
In the past week or so, many attacks have been targeting ESXi with ransomware, even
though this vulnerability was patched two years ago.
This was CVE-2021-21974, and is a heap based buffer overflow in OpenSLP listed with a critical
severity rating.
OpenSLP is a network discovery tool that's built into ESXi.
The known attack vector according to VMWare was if an actor residing in the same network
segment as ESXI had access to port 427, they could trigger the buffer overflow and this
could result in remote code execution.
VMWare patched it in February 2021 but of course, not all installations have been updated
to protect against this attack.
So suddenly, tons of vulnerable servers were hit, leaving to the computer emergency response
teams in several countries reporting the campaign activity, with over 3800 infected servers
found.
The ransomware encrypts CM files and adds the .args file extension to the end of locked
files, so the campaign has been dubbed ESXiArgs.
The ransomware isn’t perfect, though, and researchers at YoreGroup Tech Team have successfully
decrypted some of the active victims.
Victims are told to pay up 2.01 bitcoin or about $45,000 to receive an encryption key,
and data exfiltration does not appear to be a factor in these attacks.
Shortly after this news, the US Cybersecurity and Infrastructure Security Agency released
a free script to decrypt victims on their GitHub, which automates the process found
by YoreGroup Tech Team.
Technically, this script rebuilds the virtual machine from unencrypted flat files.
A few days after CISA released this script, the attacks released an update to the malware,
which targets more files and makes decryption more challenging.
They also updated the ransomware note to request that victims contact them via Tox to get the
wallet information for payment.
Updated stats show that over 1200 have been infected with the updated variant, and over
1100 of those are reinfections.
So you can’t depend on the CISA took to fix it.
Some new reports are saying some infected servers have already disabled the SLP Service,
so it’s possible the attackers are using other vulnerabilities as well.
So, if you haven’t patched to the most up to date software, so do immediately.
Admins can also isolate their servers, reinstall the hypervisor, apply patches, and block access
via firewall.
Reddit disclosed a security incident last week that occurred due to an employee’s
login credentials getting phished.
In this breach, an attacker was able to access source code, internal documents, dashboards,
business systems and contact details for hundreds of Reddit employees.
Production systems and user accounts and password data was not accessed, according to a post
about the incident.
Reddit became aware of the phishing campaign on Feb 5, when an attacker sent out prompts
to employees to a website that cloned their intranet gateway, attempting to steal employee
login credentials and the 2 factor authentication tokens.
They successfully obtained some creds, leading to internal access.
Employees impacted included former and current, as well as some advertiser information.
The employee who was phished self reported and the security team removed the rogue access.
While Reddit has no indication of user accounts being accessed, they reminded users in the
post to enable 2FA and use good password hygiene online.
We don’t know based on this post what form of multi factor authentication Reddit is requiring
it’s employees to use.
But this does sound like they are not requiring hardware based authentication using FIDO or
similar with a key such as a Yubikey.
That means employees could be susceptible to authentication or 2fa fatigue, wherein
they rely on a push prompt to authenticate and eventually choose yes because they get
tired of seeing the popup, or they may rely on OTP such as 6 digit codes sent to an authenticator
app, which can be stolen and copied by an attacker.
We’ve seen many of these attacks over the last year showing that using hardware based
authentication can be a crucial requirement for employees going into the new year.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
THANK YOU to Eric, Katie, Keith, Dan, Gabe, and Sarah for being a part of the Smores at
Patreon.com/shannonmorse.
That’s my new Patreon page for the show, where I’ll be posting all the perks for
patrons, including early access to this video.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials, like my newest video about my favorite password managers.
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about some linux ransomware!
A new exploit tracked as CVE-2023-0669 is being exploited to allow attackers to gain
remote code execution via the GoAnywhere MFT file transfer tool developed by Fortra.
The vulnerability is a zero day and the Clop ransomware gang has claimed they’re the
group behind the attacks, which so far have allowed them to steal data from 130 orgs.
According to reports, the hacking group targeted servers vulnerable to this bug over a 10 day
period, and used the unauthorized access to move laterally through networks of victims.
Huntress posted about this event as well, stating the potential responsible party may
be a group called TA505, due to similarities in activity and deployment mechanisms used
in attacks.
Fortra issued emergency security updates for the tool.
Around the same time, a proof of concept exploit was posted online by a security researcher.
The group using Clop ransomware has been on a productive streak lately, as a new Linux
variant has also been spotted in the wild.
This ELF executable is flawed, though, allowing for decryption of locked files according to
researchers at SentinelOne, who made a decryptor for this new variant.
Research shows this new Linux variant is missing several of the features of it’s counterpart
Windows version, but it’s likely we’ll see updated ransomware in the near future.
It’s currently not detected in VirusTotal, so it’s possible the threat actor hasn’t
had a need to improve obfuscation or evasiveness yet - all according to SentinelOne researcher
Antonis Terefos.
So will we see new variants in 2023?
Most likely, yes.
And the fact that a Linux version now exists tells us the group behind these attacks is
now targeting more than just Windows.
I'm Shannon Morse, I'll see you on the Internet!