SEXi / APT Inc Ransomware – What You Want To Know

SEXi? Critically? What are you speaking about this time?

Don’t be concerned, I am not making an attempt to conjure pictures in your thoughts of Rod Stewart in his iconic leopard print trousers. As a substitute, I need to warn you a few cybercrime group that has gained notoriety for attacking VMware ESXi servers since February 2024.

Excuse me for not realizing, however what’s VMWare EXSi?

EXSi is a hypervisor – permitting companies who need to cut back prices and simplify administration to consolidate a number of servers onto a single bodily machine. 

ESXi is a well-liked selection with cloud suppliers and knowledge centres which have a require to host 1000’s of digital machines for his or her clients, however there are additionally use circumstances in healthcare, finance, schooling, and different sectors.

So the SEXi gang breaks into EXSi servers and encrypts the info?

That is appropriate. As an illustration, in April Chilean knowledge centre and internet hosting supplier IxMetro PowerHost had its VMware ESXi servers and backups encrypted. The attackers demanded a ransom of $140 million price of Bitcoin.

140 million {dollars}? Sheesh!

It is rather a lot is not, is not it? Apparently, the ransomware group calculated the determine by demanding two Bitcoins for each PowerHost buyer whose knowledge had been encrypted.

Apparently, the ransomware group calculated the determine by demanding two Bitcoins for each buyer of PowerHost who had had their knowledge encrypted. 

PowerHost’s CEO says that he personally negotiated with the attackers, described the demand as “exorbitant”, and refused to pay up.

So how have you learnt in case your computer systems have, err.. obtained SEXi?

Encrypted recordsdata have their filenames appended with “.SEXi”. Recordsdata associated to digital machines, similar to digital disks, storage, and backup pictures, are focused. 

As well as, a ransom observe is dropped onto affected techniques known as SEXi.txt.

The ransom message tells victims to obtain the end-to-end encrypted messaging app Session, and make contact with the extortionists.

Are there any identified weaknesses within the encryption used within the SEXi assaults that could possibly be used to get well your knowledge with out paying?

Sadly not, and so there are not any freely out there instruments to get well encrypted knowledge. Companies hit by SEXi ransomware assaults must hope that they’ve made a backup of essential knowledge that has not been compromised by the cybercriminals.

None of this sounds very SEXI in any respect…

I agree. And perhaps the attackers do too. From final month onwards they seem to have tried to rebrand themselves with the marginally much less disturbing title of “APT Inc.” Which, after all, means an replace to the ransom observe – though not a lot has modified in the way in which the criminals function. 

What can my firm do to raised shield its VMware EXSi servers?

You possibly can considerably strengthen the safety of your VMware ESXi setting and shield helpful knowledge by following these steps:

• Replace and patch your VMware EXSi techniques towards vulnerabilities.
• Disable the default root account and create separate person accounts granting customers solely the permissions they want.
• Ensure that passwords are sturdy, can’t be guessed or cracked, and are distinctive.
• Proactively monitor and log occasions to detect potential safety breaches.

For additional recommendation, learn VMware’s suggestions for securing EXSi.

Editor’s Observe: The opinions expressed on this visitor writer article are solely these of the contributor and don’t essentially replicate these of Tripwire.