Multiple Ransomware Groups Adapt Babuk Code to Target ESXi VMs
Two years ago, a popular ransomware-as-a-service group's source code got leaked. Now other ransomware groups are using it for their own purposes.
May 11, 2023
![Image of a red skull on top of code through a magnifying glass Image of a red skull on top of code through a magnifying glass](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc8b4831f9655f808/64f1530251fd6971dfd7dcd6/Ransomware_Ton_Snoei_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Over the past year, 10 different ransomware families have utilized leaked Babuk source code to develop lockers for VMware ESXi hypervisors.
Hypervisors are programs used to run multiple virtual machines (VMs) on a single server. By targeting ESXi, hackers may be able to infect multiple VMs in an enterprise environment more directly than they could through conventional means.
A few of the Babuk-based ESXi ransomwares are associated with major threat actors like Conti and REvil. And according to Alex Delamotte, senior threat researcher at SentinelOne, a majority of them have been utilized in real-world attacks in recent months.
"It looks like it's an effective model," says Delamotte, who published the new research this week. "As long as they stay profitable, hackers are going to keep using these lockers. And it does seem like they work."
How We Got Here
Babuk was a popular though imperfect ransomware-as-a-service (RaaS) offering, first circulated in early 2021.
In September 2021, its business model was interrupted when one of the original creators had a moment of reckoning. "One of the developers for Babuk ransomware group, a 17 year old person from Russia, has been diagnosed with Stage-4 Lung Cancer," vx-underground, a repository for malware source code, wrote in a tweet. "He has decided to leaked the ENTIRE Babuk source code for Windows, ESXI, NAS."
Babuk As a Baseline
Since then, threat actors have been using Babuk's various leaked tools as a baseline for crafting new malicious payloads.
For instance, in their report published May 4, researchers from Sentinel Labs identified significant overlaps between the Babuk ESXi ransomware builder and ten other ransomware families: Cylance, Dataf Locker, Lock4, Mario, Play, Rorschach, RTM Locker, XVGV, RHKRC — closely associated with the REvil group's Revix locker — and "Conti POC" — a proof of concept from the notorious and now largely defunct ransomware group.
Delamotte says Mario, Rorschach, XVGV, and Conti POC have all been utilized in attacks already, and users on Bleeping Computer forums have reported being victim to Dataf Locker and Lock4.
Why Hackers Target ESXi
VMware ESXi, a "bare metal" hypervisor, uses no operating system as a buffer ("bare metal"), instead interfacing directly with logic hardware. It's installed directly onto a physical server with unfettered access and control over the machine's underlying resources.
All of this is what makes ESXi a powerful platform for IT administrators and, by the same token, hackers. Bad actors can aim to hit multiple VMs running on a single virtual server, utilizing "built-in tools for the ESXi hypervisor to kill guest machines, then encrypt crucial hypervisor files," Delamotte explained in the report.
Enterprises running VMware's ESXi need to be cautious, though the fix is straightforward.
"The most important thing is to ensure that any access — especially management access, to something like an ESXi hypervisor — is very limited," Delamotte advises. "You want to have good role-based access controls and definitely MFA wherever possible on any service account."
Strict, effective access controls should be enough to insulate the vulnerable. "I don't really see any situation," she says, "where somebody can move on to this kind of server without having admin privileges."
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024