Description
ESXiArgs is ransomware targeting VMware ESXi servers, a class of infrastructure whose compromise can encrypt many virtual machines at once. Its operators exploit vulnerable ESXi instances exposed to the internet, encrypt virtual disks and configuration files, and demand payment for decryption. Public analysis produced a recovery script that lets many victims restore affected configuration files, and campaigns have continued against unpatched hosts since the family first appeared.
Stats
- First seen
- February 2023
- Last seen
- October 2026
Also known as
EsxiArgs
Alert name variants
| Alert Name |
|---|
| Dump:Generic.Ransom.ESXiArgs.D.FFFFFFFE |
| Generic.Ransom.ESXiArgs.A.F354C453 |
| Generic.Ransom.ESXiArgs.B.2AB523B0 |
| Generic.Ransom.ESXiArgs.B.3047F2B1 |
| Generic.Ransom.ESXiArgs.B.56A1D4E7 |
| Generic.Ransom.ESXiArgs.B.5FB54145 |
| Generic.Ransom.ESXiArgs.D.27BADFCF |
| Generic.Ransom.ESXiArgs.D.2DE88AC3 |
| Generic.Ransom.ESXiArgs.D.3C181904 |
| Generic.Ransom.ESXiArgs.D.5E27D539 |
