Chilean hosting and data center provider, IxMetro Powerhost, was attacked by a new ransomware group named SEXi, which encrypted servers and backups on VMware ESXi.
See also: VMware fixes critical bugs in ESXi, Workstation and Fusion
PowerHost is a data center, hosting, and interconnection company with locations in the US, South America, and Europe.
On Monday, IxMetro PowerHost warned customers that it suffered a ransomware attack on Saturday morning that encrypted some of the company's VMware ESXi servers, which are used to host virtual private servers for customers.
Customers who host their websites or services on these servers are currently offline as the company attempts to recover the data from backups.
In the most recent update, PowerHost apologized to its customers, warning that it may not be possible to restore the servers as the backups have been encrypted.
While attempting to negotiate with the malicious actors to obtain the decryption key, the IxMetro PowerHost ransomware group demanded two bitcoins per victim, an amount that according to the company's CEO would be equivalent to $140 million.
See also: Broadcom: It is going to lay off 1,300 VMware employees
For VPS customers who were affected by the attack and still have their website content, the company is offering to create a new VPS so that customers can bring their websites back online.
According to CronUp cybersecurity researcher Germán Fernández, IxMetro PowerHost was attacked using a new ransomware that appends the .SEXi and drops ransom notes named SEXi.txt.
So far, attacks carried out by threat actors have been observed targeting VMWare ESXi servers. This is why the ransomware operation was named 'SEXi,' a pun on the VMWare word 'ESXi.'
However, as no sample of the cryptographer has been found yet, it is possible that they are also targeting devices with the Windows operating system .
As for the infrastructure of how the ransomware works, there is nothing special at the moment. The ransom demands simply contain a message telling victims to download the Session messaging and contact them at the registered address. Furthermore, it is not known whether the attackers steal data to blackmail companies through double extortion attacks.
See also: VMware: Recommends removal of EAP plugin due to vulnerabilities
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
How can one protect themselves from ransomware?
Protecting yourself from ransomware, like the one that IxMetro Powerhost suffered, requires a combination of preventative measures and good digital habits. First, it’s important to keep your operating system and all programs up to date. Updates often include security patches that can protect your computer from the latest ransomware attacks. Additionally, using a reputable antivirus software can help detect and prevent ransomware before it attacks your system. Education is also crucial. You should know how to recognize and avoid phishing, which are a common way ransomware is distributed. Finally, creating and maintaining regular backups of your important data is one of the most effective protection measures. If you fall victim to a ransomware attack, you will be able to restore your data from a backup instead of paying the ransom.
Source: bleepingcomputer
