Threat Bulletin

Alert essentials:
Many threat groups use this vulnerability as a post-compromise technique to create Active Directory groups on domain-joined ESXi hypervisors.

Install an upgrade or mitigate immediately.

Email Team

Detailed threat description:
At least six different ransomware groups are exploiting an Active Directory (AD) integration authentication bypass in VMware ESXi hypervisors. If an ESXi host is joined to an AD domain controller, hackers create a new group with administrative access and add themselves.

Accounts called “ESX Admins” is not a group that exists by default in AD. However, if joined to the domain, the server will provide full administrative access to this group.

Originally a zero-day, the vulnerability leads to lateral movement and deployment of malware that encrypts files.

A version upgrade is available for remediation of ESXi version 8 and VMware Cloud Foundations version 5. There is no patch planned for version 7 or older ESXi or Cloud Foundation versions 4.x or older. A proposed mitigation involves modifying certain advanced ESXi settings. Detailed instructions are available through the links provided below.

Financially motivated threat groups frequently target VMware servers due to their widespread use. To protect against these and other large-scale attacks, ensure security patches are up to date, minimize the number of open ESXi firewall ports, and consider enabling ESXi Lockdown mode.

Impacts on healthcare organizations:
Healthcare providers store vast amounts of sensitive patient data, which is often shared through interconnected and interoperable networking. A successful cyber attack not only disrupts the use of lifesaving technology but can also lead to data theft, exposing patients to identity theft and financial fraud.

Affected products / versions:

Engineering recommendations:

References: