https://agora.nasqueron.org/index.php?action=history&feed=atom&title=Operations_grimoire%2FIncidents%2F2023-02-03-ESXi 2026-04-26T20:34:04Z Revision history for this page on the wiki MediaWiki 1.46.0-alpha https://agora.nasqueron.org/index.php?title=Operations_grimoire/Incidents/2023-02-03-ESXi&diff=1105&oldid=prev 2023-02-04T16:06:55Z

<p>+complector</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 16:06, 4 February 2023</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l8">Line 8:</td> <td colspan="2" class="diff-lineno">Line 8:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>; 2023-02-04</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>; 2023-02-04</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>* 12:58:36 migration from Dreadnought to hyper-001 done for router-001</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>* 12:58:36 migration from Dreadnought to hyper-001 done for router-001</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">* 16:05:01 migration from Dreadnought to hyper-001 done for complector</ins></div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Analysis ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== Analysis ==</div></td></tr> </table>

Dereckson https://agora.nasqueron.org/index.php?title=Operations_grimoire/Incidents/2023-02-03-ESXi&diff=1104&oldid=prev 2023-02-04T15:35:49Z

<p>Created page with &quot;Not tracked on DevCentral as docker-001 is currently down. == Incident timeline == ; 2023-02-03 * 16:28:03 Dorian and Dereckson worked on pad.nasqueron.org, connection was stopped * 16:29:06 Hypervisor Dreadnought is confirmed working, attack against VMWare ESXi detected, server switched in rescue mode * 00:15:40 <a href="/Hyper-001" title="Hyper-001">hyper-001</a> provisioned ; 2023-02-04 * 12:58:36 migration from Dreadnought to hyper-001 done for router-001 == Analysis == External sources: * https://www....&quot;</p> <p><b>New page</b></p><div>Not tracked on DevCentral as docker-001 is currently down.<br /> <br /> == Incident timeline ==<br /> ; 2023-02-03<br /> * 16:28:03 Dorian and Dereckson worked on pad.nasqueron.org, connection was stopped<br /> * 16:29:06 Hypervisor Dreadnought is confirmed working, attack against VMWare ESXi detected, server switched in rescue mode<br /> * 00:15:40 [[hyper-001]] provisioned<br /> ; 2023-02-04<br /> * 12:58:36 migration from Dreadnought to hyper-001 done for router-001<br /> <br /> == Analysis ==<br /> External sources:<br /> <br /> * https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-015/<br /> * https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/<br /> <br /> First findings:<br /> <br /> * FreeBSD machines ZFS disks are intact (db-A-001, complector, router-001)<br /> * Linux machines LVM/xfs disks show I/O error (Equatower, docker-001)<br /> * https://enes.dev/ states the ...-flat.vmdk shouldn&#039;t be encrypted<br /> * Backup of the .vmx configuration file is available at .vmx~ when a machine was running during the attack<br /> <br /> == Actionables ==<br /> * Monitor VMWare ESXi last available patch vs our current version<br /> * Improve backup strategy<br /> ** ZFS storage server<br /> ** Glacier backup<br /> ** Physical backup on site<br /> * [DONE] Install NetBox to document network as we provision the hypervisor it<br /> * Plan HA for critical services, at least for DevCentral</div>

Dereckson