Esxiargs

The ESXiArgs campaign was a significant cybersecurity event where an unknown ransomware group targeted VMware ESXi environments. The attackers exploited CVE-2021-21974, a vulnerability that was two years old at the time of the attacks. The campaign involved several ransomware groups such as Royal, Black Basta, LockBit, RTM Locker, Qilin, Monti, and Akira, which are known for directly targeting victims' VMware ESXi servers to steal and encrypt files, subsequently demanding substantial ransoms. In February, reports emerged about the ESXiArgs campaign causing brief devastation to some unpatched cloud services. Initially, it was believed that the eponymous locker used in the attack was derived from Babuk, another notorious ransomware. However, upon further analysis by experts, they found "little similarity" between ESXiArgs and Babuk, leading to incorrect attributions. It was later revealed that the cybercriminals used leaked Babuk source code to target VMware ESXi servers in this widespread ransomware campaign. In response to these attacks, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) released an ESXiArgs recovery script available on GitHub. This tool is designed to assist organizations that have fallen victim to the ESXiArgs ransomware in their attempts to recover encrypted files. Despite the challenges posed by the ESXiArgs campaign, this development offers a measure of hope for affected entities seeking to mitigate the damage caused by these ransomware attacks.