Ransomware
ESXiArgs
First seen: 2023-02 • Status: inactive
Currently Inactive
ESXiArgs automatically attacked thousands of VMware servers in one weekend. It exploited an old vulnerability that many organizations had not patched.
Overview
ESXiArgs was a massive automated ransomware campaign that exploited VMware ESXi vulnerabilities, affecting thousands of servers globally.
How It Spreads
- • CVE-2021-21974 exploitation
- • Automated scanning
What It Does
- • Encrypts virtual machines
- • Targets ESXi servers
Is your business exposed?
Target Platforms
VMware ESXi
Detection Tips
- • Patch ESXi immediately
- • Check for exploitation
MITRE ATT&CK Techniques
T1486, T1190
If You're Infected
- 1.
Use CISA recovery script
- 2.
Patch ESXi servers
Related Malware
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required