New Linux Version of Ransomware Targets VMware ESXi (bleepingcomputer.com) 23
"Researchers observed a new Linux variant of the TargetCompany ransomware family that targets VMware ESXi environments," reports BleepingComputer:
In a report Wednesday, cybersecurity company Trend Micro says that the new Linux variant for TargetCompany ransomware makes sure that it has administrative privileges before continuing the malicious routine... Once on the target system, the payload checks if it runs in a VMware ESXi environment by executing the 'uname' command and looking for 'vmkernel.' Next, a "TargetInfo.txt" file is created and sent to the command and control (C2) server. It contains victim information such as hostname, IP address, OS details, logged-in users and privileges, unique identifiers, and details about the encrypted files and directories. The ransomware will encrypt files that have VM-related extensions (vmdk, vmem, vswp, vmx, vmsn, nvram), appending the ".locked" extension to the resulting files.
Finally, a ransom note named "HOW TO DECRYPT.txt" is dropped, containing instructions for the victim on how to pay the ransom and retrieve a valid decryption key. "After all tasks have been completed, the shell script deletes the payload using the 'rm -f x' command so all traces that can be used in post-incident investigations are wiped from impacted machines."
Thanks to long-time Slashdot reader joshuark for sharing the article.
Finally, a ransom note named "HOW TO DECRYPT.txt" is dropped, containing instructions for the victim on how to pay the ransom and retrieve a valid decryption key. "After all tasks have been completed, the shell script deletes the payload using the 'rm -f x' command so all traces that can be used in post-incident investigations are wiped from impacted machines."
Thanks to long-time Slashdot reader joshuark for sharing the article.
how offen are people sshing into an ESXI box? (Score:3)
how often are people sshing into an ESXI box?
Does this run on other systems to scan the network?
Re: (Score:3)
You're supposed to disable SSH access unless/until you actually need it for troubleshooting:
https://docs.vmware.com/en/VMw... [vmware.com]
Re:how offen are people sshing into an ESXI box? (Score:5, Insightful)
Actually, you are supposed to use dedicated, hardened, low-attack-surface systems for any admin logins to servers. Some people find that too much effort though and hence get hit.
Re: (Score:2)
Actually, you are supposed to use dedicated, hardened, low-attack-surface systems for any admin logins to servers. Some people find that too much effort though and hence get hit.
This. Ideally admins should be authenticating approved accounts and machines to a dedicated admin VLAN. Separating the admin broadcast segment from the user LAN, limits the attack surface further. No sense in allowing an attacker to even sniff for admin-related chatter, whether they have an employee badge or not.
Re: (Score:2)
Indeed. But too many IT security "experts" are clueless and too many organizations try to cheap-ass IT security.
Re: (Score:1)
how often are people sshing into an ESXI box?
The ssh interface is used by many backup solutions as you can iterate vms on that host, manage snapshots, and scp them out as flattened full disk images, all in one fell swoop.
There also used to be centralized vm management systems that could manage esxi over ssh, for people with the free version without vsphere.
Called Broadcom (Score:5, Funny)
I am immune to this (Score:4, Funny)
Linux ransomware infection vector (Score:4, Interesting)
Do they mean the malware can't achieve root on its own.
How is this custom script malware loaded and executed on the target?
Re:Linux ransomware infection vector (Score:4, Informative)
This is just the ransomware part. The way to get root on the target is left to other tools.
Re: (Score:2)
A total non-story then
Re: (Score:2)
Not completely. It still shows that apparently getting into Linux installations is easy enough these days that creating the tool from the story makes sense. Probably too many Windows "admins" responsible for Linux servers these days....
Re: (Score:2)
Provide a link to malware that installs itself as root without user action.
Re: (Score:2)
Why should I? I have not made any claims as to how attackers get into Linux installations. I just claimed that apparently getting into Linux installations is easy enough to justify the effort of creating the tool from the story, which represents a significant effort. Obviously, with competent system administration, it is still _not_ easy to get into Linux (unlike Windows, where you have to go to extreme measures to secure a system), but it looks very much like competent system administration is not done in
Re: (Score:2)
'tis but a scratch [youtube.com]
Given the licensing changes at VMware recently... (Score:2)
...I'd argue VMware _IS_ the ramsomware.
Oh, if only... (Score:2)
Once on the target system, the payload checks if it runs in a VMware ESXi environment by executing the 'uname' command and looking for 'vmkernel.'
Oh, if only there was a way to stop this type of attack? Perhaps, if end users could modify the uname command results to not include the text vmkernel?
Re:Oh, if only... (Score:4)
Perhaps, if end users could modify the uname command results to not include the text vmkernel?
If you execute a malware script with root privileges, the wording of the text returned by uname is the least of your worries. Sure, you might fool this particular version of this particular malware by altering that, but the next version of the malware would simply check using some other technique, and would still have access to encrypt all of your files.
Please, define "long-time Slashdot reader" (Score:2)
No offense to JOSHUARK (he's had a lot of good contributions) but if your profile ID resembles a telephone number, you're maybe not such a long-time Slashdot reader...
joshuark (6549270) [slashdot.org]
Re: (Score:2)
Sorry, meant to include this line from TFS:
Thanks to long-time Slashdot reader joshuark for sharing the article
Re: (Score:2)
Re: Please, define "long-time Slashdot reader" (Score:2)
Y'all have user IDs like P.O. Box numbers.
Send $9.95 plus shipping and handling to receive your first shipment of Bacons of the World. These highly collectible preserved meats will provide endless hours of enjoyment for you and your family. And if you act now, we will include a FREE bacon press and bacon bag.