What Happened

ESXiArgs was a ransomware campaign that targeted VMware ESXi hypervisors via CVE-2021-21974, a remote code execution vulnerability in the ESXi OpenSLP service with a CVSS score of 8.8. The vulnerability was disclosed and patched by VMware in May 2021. In February 2023, nearly two years later, attackers automated exploitation of organizations that had never applied the patch, hitting thousands of servers across Europe and North America within days.

The attack encrypted virtual machine configuration files (*.vmdk, *.vmx, *.vmxf, etc.), effectively taking down every virtual machine running on affected hosts. For organizations without current, tested backups (and without backups isolated from the compromised network), recovery required paying the ransom or rebuilding from scratch.

Why ThreeShield Clients Weren't Affected

Our approach to VMware and hypervisor management includes:

  • Proactive patching against known CVEs: We track VMware security advisories and apply critical patches within our patch windows. CVE-2021-21974 was applied to managed VMware environments in 2021.
  • Network exposure review: ESXiArgs required the ESXi management interface to be internet-exposed. Our baseline requires ESXi management interfaces to be isolated on a management VLAN, not exposed to the internet or general corporate network.
  • Backup isolation: Even if a hypervisor is compromised, our backup strategy keeps at least one current backup copy out of reach of the compromised system, so ransomware can't encrypt the backups along with the production data.

What Reacting Instead of Preventing Looks Like

For organizations hit by ESXiArgs, the incident revealed several systemic problems that predated the attack:

  • No systematic patch management: two years of critical patches missed
  • ESXi management interfaces exposed to the internet without necessity
  • Backups stored in locations accessible from the compromised network
  • No baseline security controls or monitoring that would have flagged these exposure gaps

The attack was highly automated and opportunistic. It went after unpatched ESXi servers anywhere on the internet rather than specific organizations. Every organization that was hit could have been protected by a patch applied in 2021. The attack wasn't sophisticated; the lack of basic hygiene was.

A Baseline IT Controls Approach

Instead of responding to specific threats, ThreeShield's approach to security is built around maintaining a full set of baseline controls that prevent the entire class of attacks these threats represent. Proactive patching, network segmentation, backup isolation, and monitoring are controls that protect against ESXiArgs, the next ransomware campaign, and the one after that.

Lavawall® monitors patch compliance across your entire environment (including VMware, Windows, macOS, Linux, and over 7,400 applications) continuously instead of quarterly. When a critical patch is available, you know about it and it gets applied, before it becomes a ransomware incident.