Python ransomware strikes virtual machines in ‘ultra-high-speed’ attacks
The attack was unique for its speed and use of a Python ransomware
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurityexperts have shared details about a speedy newransomwarecampaign attacking virtual machines (VM) hosted on a VMware ESXi hypervisor.
Describing it as a sniper-like operation,Sophosresearchers claim that it took the attackers less than three hours from breaching the target to encrypting it.
“This is one of the fastest ransomware attacks Sophos has ever investigated and it appeared to precision-target the ESXi platform,” said Andrew Brandt, principal researcher at Sophos.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
The researchers note that whilemalwarethat runs under aLinux-likeoperating system, such as the one ESXi uses, is still relatively uncommon, hypervisors are an attractive target since the VMs they host usually run business-critical services.
Splash and dash
Sophos researchers add that even notorious ransomware operators such as DarkSide and REvil have targeted ESXi servers.
However, two aspects of this particular attack that stand out are the swiftness shown by the attackers, and the use of thePythonransomware.
The attackers logged into the network after compromising aTeamVieweraccount that was running in the background on a computer that belonged to a user with Domain Administrator credentials.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Ten minutes after logging in the attackers downloaded an IP scanner to map the network. Soon after identifying the ESXi server, the attackers discovered that the target’s staff had mistakenly forgotten to disable the built-in SSH service in ESXi.
It didn’t take them long to log into the hypervisor to deploy the Python ransomware.
“Python is a coding language not commonly used for ransomware. However, Python is pre-installed on Linux-based systems such as ESXi, and this makes Python-based attacks possible on such systems,” reason the researchers, who managed to scrape the ransomware for analysis after putting in some serious effort.
In their analysis, the researchers unravel the 6kb ransomware which was pretty dexterous and offered several customizable options to the attackers, in order to help admins secure their environments from a similar attack.
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
A critical Palo Alto Networks bug is being hit by cyberattacks, so patch now
3 reasons why PIA fell in our best VPN rankings
HPE reveals critical security bug affecting networking access points
