The Evolution of ESXiArgs Ransomware

The Censys Research Team analyzed the ESXiArgs ransomware campaign targeting VMware ESXi hosts, reporting a surge of infections (just over 500 newly observed hosts concentrated in France, Germany, the Netherlands, and the UK) and tracing ransom-note variants back to October 2022. The report provides a timeline of activity (notable waves in February 2023), analysis of early victim hosts, differences in ransom notes and encryption methods, links to archived host data, and a public dashboard to monitor compromises and remediation status.