BR +55 11 3069 3925 | USA +1 469 620 7643

CISA and FBI Release ESXiArgs Ransomware Recovery Script

by | Feb 15, 2023 | BLOG | 0 comments

The US Cyber Security and Infrastructure Agency (CISA) and the Federal Bureau of Investigation (FBI) released this week a recovery guide for the ESXiArgs ransomware, which has harmed thousands of companies globally.

This was because malicious attackers were allegedly taking advantage of known vulnerabilities in unpatched, out-of-service or outdated versions of VMware ESXi software. Through these “loopholes” they would be deploying ESXiArgs ransomware on ESX servers, rendering these devices unusable.

The recovery tool can be found at this link and has been used by numerous corporations, who managed to recover encrypted items without paying a ransom to attackers.

However, CISA warns that to use this resource, it is essential to understand how it works. In this sense, companies harmed by ESXiArgs should evaluate the recommendations present in the README file, which comes with the script.

The number of servers infected by ESXiArgs in several countries has already exceeded 3 thousand. According to the victims, in order to decrypt the data, the hackers requested about 2 Bitcoins, which is equivalent to approximately US$ 22,800 (as of the present moment).

In addition, malicious attackers would have demanded payment of the ransom within three days, as a condition for not disclosing the organizations’ sensitive data.

As per Rapid 7, ESXiArgs attempted to shut down virtual machines by killing a process in the virtual machine’s kernel that handles I/O commands, however, in some cases it was unsuccessful as organizations were able to recover their data.

The recovery script developed by CISA in conjunction with the FBI is based on the work of researchers Enes Sonmez and Ahmet Aykac, and shows how victims can rebuild virtual machine metadata from disks that the malware was unable to encrypt.

In practice, the function of the script is to create new configuration files that allow access to the VMs and not delete encrypted files. However, CISA makes no guarantees that the script is secure.

VMware recommends that companies implement the patch released in 2021 for the vulnerability exploited by ESXiArgs. Organizations that do not fix the flaw should temporarily disable the ESXi Service Location Protocol (SLP) or still keep port 427 disabled.

Are you enjoying this post? Join our Newsletter!

Newsletter Blog EN

5 + 7 =

We will send newsletters and promotional emails. By entering my data, I agree to the Privacy Policy and the Terms of Use.

SaaS, PaaS and IaaS: Learn about theCloud Computing Options

Understand these solutions to choose the best alternative for your business. For many years, we have been using cloud computing to access files that are not stored on a computer, but on email servers, social network websites, or internet pages, without the need of...

What does a Chief Information Security Officer (CISO) do?

A Chief Information Security Officer (CISO) is a high-level professional responsible for the digital security of a company. If you aspire to obtain this position, read our text until the end. In it, we explain more about the profession. With the advancement of...

An overview of essential certifications for CISOs

In the world of cybersecurity, the role of a CISO is crucial in protecting data and sensitive information. To excel in this career, it is necessary to have certain certifications, including Certified Information Systems Security Professional (CISSP), Certified Ethical...

What is the role of a CISO during a cyber attack?

The CISO plays a crucial role in incident management during cyber attacks as they are responsible for implementing containment and eradication measures. However, it is also their role to detect and prevent threats. Learn more in this article about the responsibilities...

Security Training Best Practices for Privileged Users

It is essential to train privileged users to avoid cyber threats, as they are the primary victims of hackers. Read our article and learn how to do it. Privileged user credentials are among the main targets of cybercriminals since they allow them to access data and...