New Stealthy and Persistent Ransomware Tactics Target VMware ESXi Devices

Summary: Sygnia’s latest report outlines the rising threat of ransomware groups targeting VMware ESXi appliances, emphasizing how attackers exploit these systems to disrupt business operations while evading detection. By utilizing techniques like SSH tunneling, cybercriminals establish persistent access to networks through compromised ESXi devices. The report also highlights the importance of effective monitoring and logging practices to mitigate these threats.

Affected: Organizations utilizing VMware ESXi appliances

Keypoints :

• Ransomware groups are increasingly targeting ESXi appliances to disrupt operations and ensure stealthy persistence.
• SSH tunneling allows attackers to create semi-persistent backdoors, making malicious traffic difficult to detect.
• ESXi’s complex logging structure complicates forensic investigations, emphasizing the need for improved logging and monitoring strategies.
• Abyss Locker ransomware exemplifies the exploitation of ESXi appliances for lateral movement within networks.