Hypervisor ransomware
Ransomware that directly encrypts virtualization servers, disabling at once all the virtual machines they host; it has multiplied the impact of attacks since the early 2020s.
In most companies, servers are no longer separate physical machines but virtual machines, running by the dozen on a few host servers managed by a hypervisor. For an attacker, the hypervisor is an ideal target: instead of encrypting each server one by one, encrypting the virtual machine files on the host disables them all within minutes, email, accounting, production, sometimes backups included. Many ransomware groups have developed specific versions for the most widespread hypervisors since the early 2020s. In February 2023, a mass campaign encrypted thousands of internet-exposed servers by exploiting a vulnerability patched two years earlier. These hypervisors often escape the detection tools installed on standard workstations and servers, and their admin interfaces are sometimes reachable from the corporate network without strong authentication. Countermeasures are isolating the management network, multi-factor authentication on consoles, prompt patching and backups outside the virtualized environment. For insurance, this technique partly explains the rise in ransomware claim severity: downtime no longer depends on the number of machines encrypted, but on the ability to rebuild the entire infrastructure.
On February 3, 2023, France's CERT-FR warned of a campaign, dubbed ESXiArgs, encrypting internet-facing VMware ESXi servers through the CVE-2021-21974 flaw, patched in February 2021. Within days, more than 3,000 servers were hit worldwide, with France among the most affected countries.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.