The US Cyber Security and Infrastructure Agency (CISA) and the Federal Bureau of Investigation (FBI) released this week a recovery guide for the ESXiArgs ransomware, which has harmed thousands of companies globally.

This was because malicious attackers were allegedly taking advantage of known vulnerabilities in unpatched, out-of-service or outdated versions of VMware ESXi software. Through these “loopholes” they would be deploying ESXiArgs ransomware on ESX servers, rendering these devices unusable.

The recovery tool can be found at this link and has been used by numerous corporations, who managed to recover encrypted items without paying a ransom to attackers.

However, CISA warns that to use this resource, it is essential to understand how it works. In this sense, companies harmed by ESXiArgs should evaluate the recommendations present in the README file, which comes with the script.

The number of servers infected by ESXiArgs in several countries has already exceeded 3 thousand. According to the victims, in order to decrypt the data, the hackers requested about 2 Bitcoins, which is equivalent to approximately US$ 22,800 (as of the present moment).

In addition, malicious attackers would have demanded payment of the ransom within three days, as a condition for not disclosing the organizations’ sensitive data.

As per Rapid 7, ESXiArgs attempted to shut down virtual machines by killing a process in the virtual machine’s kernel that handles I/O commands, however, in some cases it was unsuccessful as organizations were able to recover their data.

The recovery script developed by CISA in conjunction with the FBI is based on the work of researchers Enes Sonmez and Ahmet Aykac, and shows how victims can rebuild virtual machine metadata from disks that the malware was unable to encrypt.

In practice, the function of the script is to create new configuration files that allow access to the VMs and not delete encrypted files. However, CISA makes no guarantees that the script is secure.

VMware recommends that companies implement the patch released in 2021 for the vulnerability exploited by ESXiArgs. Organizations that do not fix the flaw should temporarily disable the ESXi Service Location Protocol (SLP) or still keep port 427 disabled.