1

I have a very basic question. From what I have read, it seems these unpatched servers were directly attacked remotely through the internet via port 427. So unlike other ransomware attacks, the malware did not get into the network through phishing or from an employee accidentally downloading malicious files. Is this correct?

1
  • The attack vector most likely is via this open port. But it does not exclude any other attack vectors like phishing. Feb 12, 2023 at 9:06

1 Answer 1

3

Those servers were exposed to the internet. ESXi servers should never be exposed to internet and stay behind firewall. Check for more information: https://www.bleepingcomputer.com/news/security/new-esxiargs-ransomware-version-prevents-vmware-esxi-recovery/

1
  • 2
    Hi. Thanks very much for your reply. I have read several articles including this one. However, I have zero domain expertise, so some aspects are not clear. Also, I'm getting conflicting answers for this question. So is it correct to assume these attacks did not get in through email phishing or from an accidental download? The hackers directly attacked and got into the servers through a public facing port on the server? It wasn't a case of the malware getting into the companies network through phishing and eventually finding this unpatched weakness? Thank you for sharing your expertise. Feb 11, 2023 at 12:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .