ESXiArgs Ransomware -Recover tool is now available!

CISA has developed ESXiArgs-Recover, a tool aimed at assisting organizations in their attempts to recover virtual machines affected by ESXiArgs ransomware attacks. Some organizations have reported successful recovery of files without having to pay a ransom.

The tool has been created using publicly available resources, including a tutorial by Enes Sonmez and Ahmet Aykac. It works by reconstructing virtual machine metadata from virtual disks that were not encrypted by the malware.

Disclaimer:

CISA’s ESXiArgs script is based on findings published by the third-party researchers mentioned above. Any organization seeking to use CISA’s ESXiArgs recovery script should carefully review the script to determine if it is appropriate for their environment before deploying it. This script does not seek to delete the encrypted config files but instead seeks to create new config files that enable access to the VMs. While CISA works to ensure that scripts like this one are safe and effective, this script is delivered without warranty, either implicit or explicit. Do not use this script without understanding how it may affect your system. CISA does not assume liability for damage caused by this script.

This script is being provided “as is” for informational purposes only. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

Usage

Download this script and save it as /tmp/recover.sh. For example, with wget: wget -O /tmp/recover.sh https://raw.githubusercontent.com/cisagov/ESXiArgs-Recover/main/recover.sh
Give the script execute permissions: chmod +x /tmp/recover.sh
Navigate to the folder of a virtual machine you would like to decrypt (you may browse these folders by running ls /vmfs/volumes/datastore1). For instance, if the folder is called, run cd /vmfs/volumes/datastore1/example
Run ls to view the files. Note the name of the VM (e.g. if there is a file, the name of the VM is example).
Run the recovery script with /tmp/recover.sh [name], where [name] is the name of the virtual machine determined in step 4. If the virtual machine is a thin format, run /tmp/recover.sh [name] thin.
If successful, the decryptor script will output that it has successfully run. If unsuccessful, this may mean that your virtual machines cannot be recovered.
If the script succeeded, the last step is to re-register the virtual machine.
If the ESXi web interface is inaccessible, take the following steps to remove the ransom note and restore access (note that taking the steps below moves the ransom note to the file ransom.html. Consider archiving this file for future incident review).
- Run cd /usr/lib/vmware/hostd/docroot/ui/ && mv index.html ransom.html && mv index1.html index.html
- Run cd /usr/lib/vmware/hostd/docroot && mv index.html ransom.html && rm index.html & mv index1.html index.html
- Reboot the ESXi server (e.g., with the reboot command). After a few minutes, you should be able to navigate to the web interface.
In the ESXi web interface, navigate to the Virtual Machines page.
If the VM you restored already exists, right-click on the VM and select “Unregister”.
Select “Create / Register VM”.
Select “Register an existing virtual machine”.
Click “Select one or more virtual machines, a datastore or a directory” to navigate to the folder of the VM you restored. Select the vmx file in the folder.
Select “Next” and “Finish”. You should now be able to use the VM as normal.