The SEXi ransomware group is known for targeting VMware ESXi servers to encrypt virtual machines.
The SEXi ransomware group targets VMware ESXi servers, encrypting virtual machines and backups. The name is a deliberate play on 'ESXi', indicating a focused effort on these systems. The group has been linked to other ransomware variants based on the Babuk source code. Defenders should pay special attention to backup isolation, network segmentation, and Babuk-related TTPs, particularly within ESXi environments.
SEXi is a ransomware group that targets VMware ESXi servers, encrypting data and demanding ransom payments. They have been observed encrypting virtual machines and backups, causing significant disruptions to services. The group's name is a play on the word "ESXi," indicating a deliberate focus on these systems. SEXi has been linked to other ransomware variants based on the Babuk source code.
The SEXi ransomware group primarily targets VMware ESXi servers, encrypting virtual machines and backups.
The SEXi ransomware is linked to ransomware variants based on the Babuk source code.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.