Reuters reports that cybercriminals and not nation-state actors are believed by Italy's National Cybersecurity Agency to likely be behind the widespread ransomware attacks that targeted thousands of VMware ESXi servers worldwide.
"No evidence has emerged pointing to aggression by a state or hostile state-like entity," said the Italian agency, which added that the attack has not compromised any entity in its critical national security sectors.
While VMware has patched the security flaw exploited in the attacks two years ago, thousands of VMware ESXi instances continued to be vulnerable, with France, the U.S., and Germany accounting for most of the exposed servers.
"It's somewhat effective but has had a mixed impact. A number of organizations have recovered their virtual machines without having to restore from a backup. It appears to be targeting victims mainly in Western countries, but does not look highly sophisticated," said U.K.-based cybersecurity expert Daniel Card.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.