ESXiArgs: History, Variants, and SLP!
ID: 7f645435-c1d5-53c5-aa88-374e19054763
STIX ID: report--7f645435-c1d5-53c5-aa88-374e19054763
Feed Name: Censys Blog
Date Published: 2023-02-24
Date Updated: 2026-04-27
Author: Ivonne Francia; The Censys Research Team
This Censys Research Team report investigates the ESXiArgs ransomware campaign, identifying 13 hosts with early ransom-note variants dating to October 2022, tracking 10 Bech32 Bitcoin addresses (one observed payment), documenting a shift in February 2023 to a new variant that removed BTC addresses and changed encryption, and deploying an SLP probe that found ≤9.6% of infected hosts running SLP—suggesting additional exploitation vectors beyond CVE-2021-21974.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.