ESXiArgs is a ransomware campaign targeting VMware ESXi servers via CVE-2021-21974 vulnerability.
ESXiArgs is a ransomware campaign targeting VMware ESXi servers via the CVE-2021-21974 vulnerability, primarily impacting unpatched European organizations since February 2023. It encrypts virtual machine files such as .vmdk and .vmx to render VMs inaccessible. Defenders must patch ESXi hosts immediately, ensure offline backups are intact, and monitor for exploitation attempts against CVE-2021-21974.
ESXiArgs is a ransomware campaign that emerged in February 2023, targeting VMware ESXi servers by exploiting the CVE-2021-21974 vulnerability. It encrypts virtual machine configuration files (.vmdk, .vmx, .vmxf, .vmsd, .vmsn, .vswp, .vmss, .nvram, .vmem) rendering VMs inaccessible. The campaign compromised thousands of unpatched servers globally, primarily affecting European organizations. A decryptor was later released by CISA and FBI.
ESXiArgs exploits the CVE-2021-21974 vulnerability to compromise VMware ESXi servers.
The ESXiArgs ransomware targets virtual machine configuration files such as .vmdk, .vmx, .vmxf, .vmsd, .vmsn, .vswp, .vmss, .nvram, and .vmem.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.