ESXi ransomware campaign strikes Florida Supreme Court, worldwide universities

Threat actors show no sign of stopping following the widespread exploitation of the two-year-old vulnerability in VMware ESXi servers

Pro

Image: Getty via Future

8 February 2023

Florida’s Supreme Court is the latest high-profile target in the ongoing ransomware campaign targeting unpatched WMware ESXi servers.

A host of US and EU-based academic institutions are also among those that have been affected by attacks, according to reports from Reuters.

A spokesperson for the Florida Supreme Court told the publication that infrastructure affected in the attack was used to support elements of the Florida state court system.

However, they insisted that this was “segregated” from the Supreme Court’s main networks and as such the integrity of the state court system has not been compromised.

“Florida Supreme Court’s network and data are secure,” the spokesperson said.

The extent of the damage caused by ransomware attacks on academic institutions, which are believed to be based in Hungary, Slovakia, and the US states of Texas and Georgia, is yet to be fully realised.

These incidents represent just a few in a growing list of organisations worldwide that have been affected by the spread of ESXiArgs ransomware.

Data compiled by the crowdsourced Ransomwhere project – which tracks ransomware payments made worldwide – and collected from Censys and Shodan, revealed that, so far, more than 2,800 organisations have been impacted by the ongoing attacks.

Despite this, Ransomwhere’s analysis found that only $88,000 had been successfully extorted by cyber criminals from a total of four completed payments.

Given that the attacks only started in the last couple of days, it’s likely that future attacks will also lead to additional payments being made.

Mitigating threats

In response to the ESXiArgs ransomware campaign, the US Cybersecurity and Infrastructure Agency (CISA), released a script to recover servers impacted by attacks.

The ESXiArgs-Recover script, which can be found on GitHub, enables affected businesses to automate the recovery process, and was compiled based on publicly available resources, including a tutorial by Enes Sonmez and Ahmet Aykac, CISA said.

“This tool works by reconstructing virtual machine metadata from virtual disks that were not encrypted by the malware,” the agency said.

CISA added that it is aware that “some organisations have reported success in recovering files without paying ransoms”.

Read More: cyber security ESXi ransomware security