Python ransomware strikes virtual machines in 'ultra-high-speed' attacks

Cybersecurity experts have shared details about a speedy new ransomware campaign attacking virtual machines (VM) hosted on a VMware ESXi hypervisor.

Describing it as a sniper-like operation, Sophos researchers claim that it took the attackers less than three hours from breaching the target to encrypting it.

“This is one of the fastest ransomware attacks Sophos has ever investigated and it appeared to precision-target the ESXi platform,” said Andrew Brandt, principal researcher at Sophos.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window <<

Take a look at our list of the best virtual machine software
These are the best virtual desktop services
Here are the best malware removal software on the market

The researchers note that while malware that runs under a Linux-like operating system, such as the one ESXi uses, is still relatively uncommon, hypervisors are an attractive target since the VMs they host usually run business-critical services.

Splash and dash

Sophos researchers add that even notorious ransomware operators such as DarkSide and REvil have targeted ESXi servers.

However, two aspects of this particular attack that stand out are the swiftness shown by the attackers, and the use of the Python ransomware.

The attackers logged into the network after compromising a TeamViewer account that was running in the background on a computer that belonged to a user with Domain Administrator credentials.

Ten minutes after logging in the attackers downloaded an IP scanner to map the network. Soon after identifying the ESXi server, the attackers discovered that the target’s staff had mistakenly forgotten to disable the built-in SSH service in ESXi.

It didn’t take them long to log into the hypervisor to deploy the Python ransomware.

“Python is a coding language not commonly used for ransomware. However, Python is pre-installed on Linux-based systems such as ESXi, and this makes Python-based attacks possible on such systems,” reason the researchers, who managed to scrape the ransomware for analysis after putting in some serious effort.

In their analysis, the researchers unravel the 6kb ransomware which was pretty dexterous and offered several customizable options to the attackers, in order to help admins secure their environments from a similar attack.