The US, France, Italy, and others warn about a ransomware attack on VMware ESXi servers, despite a February 2021 patch; Censys: 3,200+ servers have been hacked
Description OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551 … Edward Hawkins / VMware Security Blog : VMware Security Response Center (vSRC) Response to ‘ESXiArgs’ Ransomware Attacks Elvira Pollina / Reuters : Italy sounds alarm on large-scale computer hacking attack Liam Tung / ZDNet : VMware warns of ransomware attacks on unpatched ESXi hypervisors Sergiu Gatlan / BleepingComputer : VMware warns admins to patch ESXi servers, disable OpenSLP service Katie Rees / MakeUseOf : Unpatched VMWare Vulnerability Used by Hackers to Target Servers and Spread Ransomware Eduard Kovacs / SecurityWeek : VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks Caitlin Condon / Rapid7 : Ransomware Campaign Compromising VMware ESXi Servers Kyle Alspach / CRN : Ransomware Targeting VMware Vulnerability Has Hit Hundreds Of Servers In US, Canada: Cyber Firm Mastodon: Kevin Beaumont / @GossiTheDog@cyberplace.social : VMware have a statement out for #ESXiArgs — Basically, get to a supported release and apply patches. OpenSLP is disabled by default in later releases. — I've assessed nearly 500 owned boxes this evening, all of them are on old software releases. … Tweets: Jeremy Kirk / @jeremy_kirk : VMware says the “ESXiArgs” ransomware blitz affected significantly out-of-date ESXi products that were targeted with exploits for vulnerabilities patched long ago. Easy lesson there (maybe don't expose ESXi to the internet, either): https://blogs.vmware.com/... #infosec @cz_binance : If you use VMWare, make sure your instances are up to date. » Ransomware hacking campaign targets Europe and North America, Italy warns. https://www.politico.eu/...
Context & Ripple Effects
The campaign follows a long-running pattern of VMware systems attracting attacker attention: researchers had already observed mass scanning of vulnerable VMware servers after an earlier remote-code-execution patch, and VMware later pressed customers to address another critical vCenter and vSphere flaw.
The immediate issue is not a newly disclosed exploit but the persistence of out-of-date ESXi installations. VMware says the ESXiArgs attacks do not show evidence of zero-day exploitation, while Censys puts the compromised-server count above 3,200.
First-order effects
- Organizations running unpatched ESXi must move to supported releases, apply VMware’s updates, and disable OpenSLP; compromised operators face encrypted systems rather than a preventive patching task.
- US, French, and Italian warnings turn a vendor advisory into an operational incident for affected administrators, while VMware must support remediation for customers still on outdated deployments.
Second-order effects
- CISA’s subsequent ESXiArgs recovery script gives affected organizations a recovery path, shifting incident-response work from identifying the exposure to restoring encrypted files where possible.
- The incident reinforces the urgency behind CISA’s earlier order for civilian agencies to patch or remove actively exploited VMware products, increasing pressure on public-sector and enterprise teams to inventory aging virtualization infrastructure.
Third-order effects
- If repeatedly patched VMware services remain reachable and unmaintained, ransomware operators will continue to treat legacy virtualization estates as a scalable target set rather than needing new zero-days.
- The pattern favors security programs that tie asset inventory and support-lifecycle enforcement directly to patch deployment, especially for infrastructure that can expose many workloads through one server.
The trend: Ransomware campaigns are increasingly exploiting the gap between a vendor patch’s availability and customers’ ability to retire or remediate unsupported infrastructure.