AA23-039A: ESXiArgs Ransomware Virtual Machine Recovery Guidance

Original release date: February 8, 2023

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory (CSA) in response to the ongoing ransomware campaign, known as “ESXiArgs.” Malicious actors may be exploiting known vulnerabilities in VMware ESXi servers that are likely running unpatched and out-of-service or out-of-date versions of VMware ESXi software to gain access and deploy ransomware. The ESXiArgs ransomware encrypts configuration files on ESXi servers, potentially rendering …

access advisory agency campaign cisa configuration csa cybersecurity cybersecurity advisory esxi esxiargs esxiargs ransomware exploiting fbi february federal federal bureau of investigation files guidance infrastructure infrastructure security investigation known vulnerabilities machine malicious malicious actors may ransomware recovery recovery guidance release response security servers service software unpatched virtual virtual machine vmware vmware esxi vmware esxi servers vulnerabilities