Virtual machines are an increasingly used resource in the IT sector. This allows creating and running a multitude of small computers on a single computer, that hosts them all. Recently, a new type of ransomware capable of attacking these devices has been discovered.
The security solutions manufacturer Sophos has published details about a new ransomware programmed in Python that attackers use to encrypt virtual machines hosted on ESXi servers. In addition, They have discovered that this ransomware is very fast and could encrypt an entire machine in just 3 hours.
Researchers believe that the ESXi server connected to the network was vulnerable because it had an active Shell, an open command interface to execute orders on the machine. This would allow an attacker to install a communication tool to gain remote access to the system, including the server's virtual hard drives and thus encrypt the virtual machines.
To conclude the investigation, some recommendations are issued. The first recommends that administrators of these systems follow common security practices, such as using unique passwords that are hard to brute-force and using two-factor authentication whenever possible. It is also recommended to disable the Shell if it is not in use at those times.
Fountain: HelpNet Security
Image: Pixabay