ESXiArgs: ransomware for unpatched VMware hosts
Thousands of ESXi servers were encrypted this week through a bug patched two years ago. Check yours today.
Since Friday, a ransomware wave called ESXiArgs has encrypted thousands of VMware ESXi servers around the world. The way in is CVE-2021-21974, a bug in the OpenSLP service that VMware fixed in February 2021.
Two years unpatched, with the management interface open to the internet. That’s all it took.
If you run ESXi:
- Patch to a current release for your version.
- Disable the SLP service if you don’t use it (most don’t). VMware has a short guide.
- Never expose ESXi or vCenter to the internet. Management goes through a VPN or a management network.
- Back up outside the hypervisor. If the host is encrypted, backups stored on it go too.
If you’re already hit: CISA has published a recovery script that has helped some victims rebuild their virtual machines without paying. Check it before you do anything drastic.
Hypervisors run everything else. They deserve patching first, not last.