CYPHERLOCK, INC.

Microsoft Alerts: Over 20,000 VMware ESXi Systems at Risk of Widespread Exploits

Microsoft has issued an urgent security warning about a critical flaw in VMware ESXi hypervisors that ransomware attackers are actively exploiting.

As reported by the Shadowserver Foundation, the vulnerability, known as CVE-2024-37085, has affected 20,275 systems as of July 30, 2024.

Overview of the Vulnerability

The flaw, identified as CVE-2024-37085, is an authentication bypass with a CVSS rating of 6.8. It targets domain-joined ESXi hypervisors, permitting attackers with sufficient Active Directory (AD) permissions to gain complete administrative access. This access can lead to severe repercussions, such as file system encryption, disruption of virtual machines (VMs), data theft, and further network intrusion.

Active Exploitation

Microsoft’s findings reveal that various ransomware gangs are exploiting this vulnerability. Groups like Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have been observed using this flaw. Typically, they exploit the vulnerability by creating a domain group called “ESX Admins,” adding users to this group, and thus granting full control over the ESXi hypervisor.

One prominent incident involved the Storm-0506 group deploying Black Basta ransomware. They initially breached systems via a Qakbot infection, exploited a Windows CLFS vulnerability (CVE-2023-28252) for privilege escalation, and then used tools like Cobalt Strike and Pypykatz to move laterally within the network. They eventually created the “ESX Admins” group to exploit the ESXi vulnerability.

The exploitation of CVE-2024-37085 has caused significant disruptions, with ransomware operators encrypting the hypervisor’s file system and incapacitating hosted VMs. This has major implications for service availability, data integrity, and unauthorized access to sensitive information.

Recommended Actions

Broadcom has issued updates to address CVE-2024-37085. It is crucial for administrators to apply these patches immediately. For systems that cannot be patched, VMware suggests modifying specific settings to mitigate the risk:

  • Set Config.HostAgent.plugins.hostsvc.esxAdminsGroupAutoAdd to false.
  • Adjust Config.HostAgent.plugins.vimsvc.authValidateInterval from 1440 to 90.
  • Set Config.HostAgent.plugins.hostsvc.esxAdminsGroup to an empty string.

Additionally, Microsoft advises enforcing multifactor authentication (MFA) for all accounts, segregating privileged accounts from regular ones, and strengthening the security of critical infrastructure like ESXi hypervisors and vCenters.

Organizations utilizing VMware ESXi hypervisors should urgently apply the suggested updates and adhere to best practices to safeguard against ransomware threats.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day