Monday, May 12, 2025
HomeCyber Security NewsHackers Deploy New Python Malware on VMware ESXi Server to gain Remote...

Hackers Deploy New Python Malware on VMware ESXi Server to gain Remote Access

Published on

SIEM as a Service

Follow Us on Google News

A backdoor was found on a VMware ESXi virtualization server by Juniper Threat Labs. Reports say two vulnerabilities in the ESXi’s OpenSLP service, CVE-2019-5544 and CVE-2020-3992 have been the target of active in-the-wild attacks since 2019 on unpatched ESXi servers.

“Due to limited log retention on the compromised host we investigated, we can’t be sure which vulnerability allowed hackers access to the server”, mentions Juniper Threat Labs

A Custom Python Backdoor for VMWare ESXi Servers

A virtualization platform called VMware ESXi is frequently used in businesses to run several servers on a single device while more efficiently leveraging CPU and memory resources.

- Advertisement - Google News

The system files for the host OS are kept in RAM and any changes are erased upon a reboot, whereas the virtual disc images for these VMs are kept on the ESXi’s physical disk.

One of the few ESXi files that survive between reboots and is run on startup is “/etc/rc.local.d/local.sh,” and the new Python backdoor adds seven lines to it. Researchers say by default, this file is empty other than comments explaining and discouraging its use.

Additional lines added on ESXi file

The system file /bin/hostd-probe.sh is automatically run when the system boots and the first seven lines inexplicably prepend one line of code to it.

One of those lines initiates a Python script saved as “/store/packages/vmtools.py” in a directory where VM disc images, log files, and other things are kept.

“While the Python script used in this attack is cross-platform and can be used with little or no modification on Linux or other UNIX-like systems, there are several indications that this attack was designed specifically to target ESXi”, Juniper Networks’ report.

Also, the name of the file and its location, /store/packages/vmtools.py, was chosen to raise little doubt on a virtualization host. Researchers say the file begins with a VMware copyright consistent with publicly available examples and is taken character-for-character from an existing Python file provided by VMware.

The script launches a web server that accepts password-protected POST requests from the remote threat actors. Thus, these requests may send the host a reverse shell command payload that is base-64 encoded.

Further, to bypass firewall restrictions or circumvent poor network connectivity, the reverse shell enables the compromised server to start communication with the threat actor.

A reverse shell is a terminal session that is running on the compromised machine, but it is “reversed” in that it establishes the network connection.

“Using a reverse shell can bypass firewall restrictions and works even when the compromised machine is not directly accessible from the internet”, researchers

Changes to the ESXi reverse HTTP proxy configuration to enable remote access to communicate with the planted webserver was one of the threat actors’ actions that Juniper’s analysts noted.

Hence, any changes made to the “/etc/vmware/rhttpproxy/endpoints.conf” file used to set up this new configuration are persistent because it is also backed up and restored after a reboot.

Recommendations

  • Apply every vendor patch.
  • Restrict incoming network connections to trusted hosts.
  • Check for the existence of the files mentioned above, either their existence or their contents. Local. sh should only include comments and an exit statement by default.
  • Verify all modified persistent system files for unexpected changes.

Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core...

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded...

20-Year-Old Proxy Botnet Network Dismantled After Exploiting 1,000 Unpatched Devices Each Week

A 20-year-old criminal proxy network has been disrupted through a joint operation involving Lumen’s...

“PupkinStealer” – .NET Malware Steals Browser Data and Exfiltrates via Telegram

A new information-stealing malware dubbed “PupkinStealer” has emerged as a significant threat to individuals...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core...

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded...

20-Year-Old Proxy Botnet Network Dismantled After Exploiting 1,000 Unpatched Devices Each Week

A 20-year-old criminal proxy network has been disrupted through a joint operation involving Lumen’s...