CrowdStrike Warns VMware’s Hypervisor ‘Highly Attractive’ To Cybercriminals

‘This trend is especially noteworthy given that ESXi, by design, does not support third-party agents or antivirus software and VMware states in its documentation that antivirus software is not required,’ CrowdStrike wrote in a blog published Monday.

Endpoint security specialist CrowdStrike is warning VMware users that the virtualization all-star’s popular ESXi hypervisor has proven to be a major target for cybercriminals this year and it expects that trend to continue.

“This trend is especially noteworthy given that ESXi, by design, does not support third-party agents or antivirus software and VMware states in its documentation that antivirus software is not required,” CrowdStrike wrote in a blog published Monday. “This, combined with the popularity of ESXi as a widespread and popular virtualization and management system, makes the hypervisor a highly attractive target for modern adversaries.”

VMware responded to the blog in a statement to CRN saying the exploits CrowdStrike mentioned were fixed two to three years ago.

[RELATED: CrowdStrike Unveils Managed XDR: 5 Big Things To Know]

The company said recent exploits that have been used by cybercriminals to control its hypervisor resulted from old instances, and bad “security hygiene.” In a statement, VMware said it was already widely reported that ransomware operators were targeting “End of General Support (EOGS) and/or out-of-date products with vulnerabilities that were addressed and disclosed at least 2-3 years ago” in VMware Security Advisories.

“As the Crowdstrike report mentions, ransomware operators gain initial access by exploiting known vulnerabilities in unpatched software and other security hygiene gaps, and customers should understand that EDR and antivirus solutions are not a substitution for core security practices such as patching known vulnerabilitie,” a VMware spokesperson wrote to CRN.

In the blog, which was writen by an unnamed author, CrowdStrike said VMware’s virtual infrastructure products are highly attractive targets for attackers due to the product’s popularity, and its use as the building-block of most modern IT environments.

“More and more threat actors are recognizing that the lack of security tools, lack of adequate network segmentation of ESXi interfaces, and ITW vulnerabilities for ESXi create a target-rich environment,” the CrowdStrike blog stated. “In April 2023, for example, CrowdStrike Intelligence identified a new RaaS program named MichaelKors, which provides affiliates with ransomware binaries targeting Windows and ESXi/Linux systems. Other RaaS platforms capable of targeting ESXi environments, such as Nevada ransomware, have also been launched.”

The blog also cited attacks in September 2022 which were documented by Mandiant researchers who discovered a novel malware ecosystem targeting VMware ESXi and VMware vCenter servers.

Near the same time, CrowdStrike said it found ESXi servers used for post-exploit activities “to maintain persistence in networks via compromised vCenter servers. Moreover, SCATTERED SPIDER leveraged the open-source proxy tool rsocx to maintain access to victim ESXi servers.”

According to VMware documentation, the ESXi hypervisor architecture has numerous built-in security features such as: CPU isolation, memory isolation, and device isolation. Users can also configure additional security such as lockdown mode, certificate replacement, and smart card authentication for enhanced security.

VMware goes on to state that an ESXi host is also protected with a firewall. Users can open ports for incoming and outgoing traffic as needed, but should restrict access to services and ports. Using the ESXi lockdown mode and limiting access to the ESXi Shell can further contribute to a more secure environment. ESXi hosts participate in the certificate infrastructure. Hosts are provisioned with certificates that are signed by the VMware Certificate Authority (VMCA) by default.