Ransomware Gang Encrypts Servers with Python Script

Share post:

In a recent discovery by Sophos security researchers, operators of an unidentified ransomware gang are currently using a Python script to encrypt virtual machines on vulnerable VMware ESXi servers.

According to SophosLabs Principal Researcher Andrew Brandt, “In what was one of the quickest attacks Sophos has investigated, from the time of the initial compromise until the deployment of the ransomware script, the attackers only spent just over three hours on the target’s network before encrypting the virtual disks in a VMware ESXi server.”

To achieve their goal, the attackers infiltrated the victim’s network by logging into a TeamViewer account that had a domain admin logged in to it. Afterwards, they used the Advanced IP Scanner to search for additional targets and simultaneously login to an ESXi server via the built-in SSH ESXi shell service.

They then executed a 6kb Python script (which allows attackers to use multiple encryption keys and email addresses and customize the file suffix for the encrypted files) to encrypt the virtual disk and VM settings files of all virtual machines.

For more information, read the original story in Bleeping Computer.

SUBSCRIBE NOW

Related articles

Cyber Security Today, Week in Review for week ending Friday May 17, 2024

Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, May 17th,...

Cyber Security Today, May 17, 2024 – Malware hiding in Apache Tomcat servers

Malware hiding in Apache Tomcat servers, new backdoors found, and more Welcome to Cyber Security Today. It's Friday, May...

MIT students exploit blockchain vulnerability to steal 25 million dollars

Two MIT students have been implicated in a highly sophisticated cryptocurrency heist, where they reportedly exploited a vulnerability...

Cyber Security Today, May 15, 2024 – Ebury botnet still exploits Linux servers, Microsoft, SAP and Apple issue security updates

The Ebury botnet continues to exploit Linux servers, Microsoft, SAP and Apple issue security updates, and more. Welcome to...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways