Massive Ransomware Attack Targets VMware ESXi Servers

The report details a widespread ESXi Args ransomware campaign exploiting CVE-2021-21974 to target VMware ESXi servers (around 1,000 infected globally). It analyzes the encrypt.sh orchestrator and an ELF encryptor (SHA256: 11b1b237...), describes targeted VM file extensions and persistence/cleanup actions (renaming VM config entries, replacing index.html and /etc/motd with ransom notes, deleting logs), outlines the crypto (RSA + Sosemanuk) and usage parameters, provides IOCs and MITRE ATT&CK mappings, and recommends patching vulnerable ESXi versions, checking for malicious vmtools.py, restoring offline backups, and disabling unnecessary services such as port 427.