Active ESXiArgs Ransomware Campaign

Arctic Wolf Labs analyzed an active, global ransomware campaign (ESXiArgs) targeting internet-exposed VMware ESXi servers by likely exploiting CVE-2021-21974 in the OpenSLP service. The attackers deploy a script and an encryptor that targets VM-related files (.vmdk, .vmx, .nvram, .vmem, etc.), use a Tox ID in identical ransom notes, and employ a Sosemanuk-based cipher (likely derived from Babuk code); Arctic Wolf provides technical details, detection artifacts, and mitigation guidance (patch ESXi, disable SLP if needed, avoid exposing ESXi, and consider CISA recovery tools).