Describing it as a sniper-like procedure, Sophos researchers claim that it took the attackers fewer than a few hrs from breaching the goal to encrypting it.
“This is one particular of the swiftest ransomware attacks Sophos has ever investigated and it appeared to precision-focus on the ESXi system,” stated Andrew Brandt, principal researcher at Sophos.
We’re searching at how our audience use VPNs with streaming web pages like Netflix so we can boost our articles and offer improved assistance. This study will not acquire more than 60 seconds of your time, and we would massively appreciate if you’d share your encounters with us.
The researchers note that while malware that runs under a Linux-like operating system, such as the one ESXi uses, is still relatively uncommon, hypervisors are an attractive target since the VMs they host usually run business-critical services.
Splash and dash
Sophos researchers add that even notorious ransomware operators such as DarkSide and REvil have targeted ESXi servers.
However, two aspects of this particular attack that stand out are the swiftness shown by the attackers, and the use of the Python ransomware.
The attackers logged into the network after compromising a TeamViewer account that was running in the background on a computer that belonged to a user with Domain Administrator credentials.
Ten minutes after logging in the attackers downloaded an IP scanner to map the network. Soon after identifying the ESXi server, the attackers discovered that the target’s staff had mistakenly forgotten to disable the built-in SSH service in ESXi.
It didn’t take them long to log into the hypervisor to deploy the Python ransomware.
“Python is a coding language not commonly used for ransomware. However, Python is pre-installed on Linux-based systems such as ESXi, and this makes Python-based attacks possible on such systems,” reason the researchers, who managed to scrape the ransomware for analysis after putting in some serious effort.
In their analysis, the researchers unravel the 6kb ransomware which was pretty dexterous and offered several customizable options to the attackers, in order to help admins secure their environments from a similar attack.