<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,
<div><br>
</div>
<div>I hope everyone is doing well!</div>
<div><br>
</div>
<div>Below is the entry for today.</div>
<div><br>
</div>
<div>10/05/2021 - Diary entry #362:</div>
<div><br>
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div>
<p>During a recent attack, a custom Python malware was discovered, targeting VMWare ESX hypervisor to encrypt all the virtual disks, effectively shutting down the organization's Virtual Machines. In this very quick attack, the threat actors spent around three
hours on the target's network before encrypting the virtual disks in a VMware ESXi server.</p>
<p><br>
</p>
<p>The initial access was obtained by compromising a TeamViewer account that didn't have multi-factor authentication configured. TeamViewer is a legitimate remote access software, which in this attack, was running in the background on a computer that belongs
to a user with a privileged account in the target's network.</p>
<p><br>
</p>
<p>Next, they downloaded and executed a tool called "Advanced IP Scanner" to enumerate other targets on the same network. With those other targets, the attackers logged in to a VMware ESXi server using an SSH client called Bitvise, where they luckily found
an ESXi Shell enabled - which was not supposed to be enabled by default.</p>
<p><br>
</p>
<p>Finally, the attackers deployed a Python script on the ESXi datastore, containing the virtual disk images used by the VMs that run on the hypervisor. After shutting down all of them, it then encrypts, overwrites, and deletes the original datastore volumes.
Each datastore was encrypted via the open-source tool "openssl", using different unique key pairs.</p>
<p><br>
</p>
<p>Hypervisors are highly valuable targets since they run critical services within a company, as we covered in some Daily Diaries (such as HelloKitty on Daily #305, Sodinokibi on #294, and RansomExx on #199) this is not the first time a Ransomware gang targets
ESX servers. Therefore, it is important to enhance security measures, and ensure that dangerous features are disabled after their usage, like the ESXi Shell in this attack.</p>
</div>
</blockquote>
<div><br>
</div>
Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:felipe.tarijon@appgate.com" title="mailto:felipe.tarijon@appgate.com">
felipe.tarijon@appgate.com</a></span><br>
O:<span> </span><span style="margin:0px; background-color:white">+55 11 97467 9549</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>