Ransomware Targeting Hyper-V and VMware ESXi Surges as Akira Group Exploits System Vulnerabilities
A recent series of ransomware attacks has been identified, targeting virtual machine platforms. The Akira ransomware group has initiated a campaign against Hyper-V and VMware ESXi systems.
A recent series of ransomware attacks has been identified, targeting virtual machine platforms. The Akira ransomware group has initiated a campaign against Hyper-V and VMware ESXi systems.
The attacks specifically threaten enterprise environments that utilize virtualization for essential operations. Akira has developed tools designed to encrypt virtual machines rapidly, resulting in significant disruptions.
The ransomware targets the hypervisor layer, which manages multiple virtual machines on a single physical server. Upon gaining access, attackers can encrypt numerous virtual machines simultaneously, amplifying the impact of the attack.
This method is notably effective against organizations operating data centers and cloud services. The encryption process locks critical systems, compelling organizations to consider paying ransoms or relying on backups for recovery.
Huntress security researchers have identified this campaign after observing unusual patterns in virtualization environments. Their analysis indicates that the Akira group has refined its techniques to exploit common security vulnerabilities in hypervisor configurations.
A recent series of ransomware attacks has been identified, targeting virtual machine platforms.
The malware propagates through compromised credentials and unpatched vulnerabilities, achieving administrative access to ESXi and Hyper-V hosts before initiating the encryption process.
Specifically, the ransomware targets virtual machine disk files and configuration data, executing encryption and attempting to disable backup services and delete recovery snapshots. This strategy reduces restoration options, pressuring victims to negotiate with attackers.
The infection process heavily depends on initial access through weak or stolen administrative credentials. Once access is secured, attackers conduct reconnaissance to map the virtual infrastructure and identify high-value targets. Platform-specific executables are then deployed, with distinct versions for Windows-based Hyper-V and Linux-based ESXi.
The ESXi variant uses command-line parameters to manage encryption behavior, allowing attackers to customize their approach based on the target environment. For example:
./akira_esxi --encryption-mode fast --exclude-vm backup-server
This capability enables attackers to maximize impact while evading detection by monitoring systems that could track suspicious activity.
Based on reporting by Cyber Security News.