ESXiArgs Ransomware Globally Targets Unpatched ESXi Servers Worldwide

UPDATE 2023/02/07: Added CISA ESXiArgs-Recover Tool in Q&A and APPENDIX section.FortiGuard Labs is aware of reports that ESXi servers around the globe that are vulnerable to the VMware ESXi OpenSLP HeapOverflow vulnerability (CVE-2021-21974) are being exploited through the OpenSLP (port 427) to deliver a new ransomware "ESXiArgs". The ransomware encrypts files in affected ESXi servers and demand a ransom for file decryption.Why is this Significant?This is significant because a new ransomware "ESXiArgs" is being deployed to ESXi servers that are …

amp aware cisa cve cve-2021-21974 decryption demand esxi esxiargs esxiargs ransomware exploited files labs port ransom ransomware recover reports servers tool unpatched update vmware vmware esxi vulnerability vulnerable