Ransomware attacks exploiting a vulnerability within the VMware ESXi OpenSLP service.

This is an alert from the Knexgen CyberGuard security team regarding a significant increase of ransomware attacks over the last 24 hours. We have observed that attackers are actively exploiting a critical vulnerability within the VMware ESXi OpenSLP service, tracked as CVE-2021-21974 after successful exploit we are observing attackers deploy ransomware on the infiltrated infrastructure.

The vulnerability can be exploited remotely by unauthenticated attackers in low complexity attacks that don't require user interaction. Once exploited the attackers can issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

The vulnerability has been rated with a CVSSv3 base score of 9.8 out of 10, making it one of the most serious threats to system security today.

If you need any advise on this please contact us