In early February 2023 a ransomware campaign named ESXiArgs encrypted VMware ESXi hypervisors at scale. CISA and the FBI published recovery guidance on 8 February, together with a script that reconstructed virtual machine metadata from disks the malware had not encrypted.
The route in was CVE-2021-21974, a heap overflow in the OpenSLP service, exploitable without authentication over the network. A patch had been available since February 2021.
Nothing About This Was New
The corpus spends a great deal of time on zero-days, because they are the cases where a defender did everything right and lost anyway. This file is the opposite and is worth keeping for exactly that reason.
Reporting placed the affected systems predominantly on ESXi 6.x and earlier, including end-of-life versions. The population was not organisations that failed to patch quickly; it was organisations running hypervisors nobody had looked at in years.
One Host, Many Machines
A hypervisor is a force multiplier for an attacker in the same way it is for an operator. Encrypting the host reaches every virtual machine on it without touching any of them individually, and it does so beneath the layer where most endpoint tooling is installed.
That is why the victim count and the machine count diverge so sharply here, and why neither number is really the measure of the harm.
The Malware Changed When The Fix Appeared
Reporting described a modified variant appearing after the recovery script was published, encrypting more of the file to defeat the reconstruction technique. The defenders published a remedy and the operators shipped a change.
The corpus records the same adaptive loop at 26-0707, where a botnet reconstituted within six days of seizure. Publishing a fix is a move in an exchange, not the end of one.
Built on the CISA/FBI joint advisory AA23-039A carrying the recovery guidance, and on contemporaneous technical reporting of the campaign and the subsequent variant. The figure of more than 3,800 compromised servers is from that reporting, derived from internet scanning rather than from victim notification, and is stated as reported. No attribution is made: the advisory names no actor and this desk does not infer one. No indicators are reproduced. Graded high on the vulnerability, the campaign and the recovery guidance. Corrections: corrections@forensicpost.com.
- ESXiArgs Ransomware Virtual Machine Recovery GuidanceCybersecurity and Infrastructure Security Agency
- Ransomware Campaign Compromising VMware ESXi ServersRapid7