‘Massive’ new ESXiArgs ransomware campaign has compromised thousands of victims

European cybersecurity authorities are warning of “massive active network exploitation” of an almost 2-year-old VMWare ESXi vulnerability by ransomware actors.

The campaign is being named ESXiArgs because the ransomware creates an additional file with the extension .args after encrypting a document. The file contains information about how to decrypt the victim document, researchers say.

Thousands of servers in Europe and North America have already been compromised, according to Censys searches for systems displaying a ransom note.

As VMWare describes ESXi, …

america campaign censys compromised cybersecurity decrypt document esxi esxiargs esxiargs ransomware europe exploitation extension file information network north north america old ransomware researchers searches servers victim vmware vmware esxi vulnerability warning