Latest Vmware ESXi news

Linux version of RansomHub ransomware targets VMware ESXi VMs

The RansomHub ransomware operation is using a Linux encryptor designed specifically to encrypt VMware ESXi environments in corporate attacks.
- Bill Toulas
- June 20, 2024
- 03:00 PM
- 0
UNC3886 hackers use Linux rootkits to hide on VMware ESXi VMs

A suspected Chinese threat actor tracked as UNC3886 uses publicly available open-source rootkits named 'Reptile' and 'Medusa' to remain hidden on VMware ESXi virtual machines, allowing them to conduct credential theft, command execution, and lateral movement.
- Bill Toulas
- June 20, 2024
- 01:46 PM
- 0
Linux version of TargetCompany ransomware focuses on VMware ESXi

Researchers observed a new Linux variant of the TargetCompany ransomware family that targets VMware ESXi environments using a custom shell script to deliver and execute payloads.
- Bill Toulas
- June 05, 2024
- 07:17 PM
- 0
The Week in Ransomware - April 5th 2024 - Virtual Machines under Attack

Ransomware attacks targeting VMware ESXi and other virtual machine platforms are wreaking havoc among the enterprise, causing widespread disruption and loss of services.
- Lawrence Abrams
- April 05, 2024
- 05:59 PM
- 0
Hosting firm's VMware ESXi servers hit by new SEXi ransomware

Chilean data center and hosting provider IxMetro Powerhost has suffered a cyberattack at the hands of a new ransomware gang known as SEXi, which encrypted the company's VMware ESXi servers and backups.
- Lawrence Abrams
- April 03, 2024
- 05:58 PM
- 4
VMware fixes critical sandbox escape flaws in ESXi, Workstation, and Fusion

VMware released security updates to fix critical sandbox escape vulnerabilities in VMware ESXi, Workstation, Fusion, and Cloud Foundation products, allowing attackers to escape virtual machines and access the host operating system.
- Bill Toulas
- March 06, 2024
- 10:39 AM
- 3
RansomHouse gang automates VMware ESXi attacks with new MrAgent tool

The RansomHouse ransomware operation has created a new tool named 'MrAgent' that automates the deployment of its data encrypter across multiple VMware ESXi hypervisors.
- Bill Toulas
- February 15, 2024
- 01:52 PM
- 0
Linux version of Qilin ransomware focuses on VMware ESXi

A sample of the Qilin ransomware gang's VMware ESXi encryptor has been found and it could be one of the most advanced and customizable Linux encryptors seen to date.
- Lawrence Abrams
- December 03, 2023
- 04:07 PM
- 0
Microsoft fixes Windows Server VMs broken by October updates

Microsoft fixed a known issue causing blue screens and boot failures in Windows Server 2022 virtual machines (VMs) deployed on VMware ESXi hosts.
- Sergiu Gatlan
- November 15, 2023
- 03:51 PM
- 2
Microsoft shares temp fix for broken Windows Server 2022 VMs

Microsoft publicly acknowledged a known issue causing Windows Server 2022 virtual machine (VM) blue screens and boot failures on VMware ESXi hosts.
- Sergiu Gatlan
- November 09, 2023
- 01:07 PM
- 0
MGM casino's ESXi servers allegedly encrypted in ransomware attack

An affiliate of the BlackCat ransomware group, also known as APLHV, is behind the attack that disrupted MGM Resorts' operations, forcing the company to shut down IT systems.
- Ionut Ilascu
- September 14, 2023
- 06:52 PM
- 3
Monti ransomware targets VMware ESXi servers with new Linux locker

The Monti ransomware has returned to action after a two-month hiatus, now targeting primarily legal and government organizations, and VMware ESXi servers using a new Linux variant that is vastly different from its predecessors.
- Bill Toulas
- August 14, 2023
- 12:12 PM
- 0
The Week in Ransomware - August 4th 2023 - Targeting VMware ESXi

Ransomware gangs continue to prioritize targeting VMware ESXi servers, with almost every active ransomware gang creating custom Linux encryptors for this purpose.
- Lawrence Abrams
- August 04, 2023
- 07:12 PM
- 1
Linux version of Abyss Locker ransomware targets VMware ESXi servers

The Abyss Locker operation is the latest to develop a Linux encryptor to target VMware's ESXi virtual machines platform in attacks on the enterprise.
- Lawrence Abrams
- July 29, 2023
- 11:17 AM
- 0
The Week in Ransomware - June 30th 2023 - Mistaken Identity

A case of mistaken identity and further MOVEit Transfer data breaches continue dominated the ransomware news cycle this week.
- Lawrence Abrams
- June 30, 2023
- 05:33 PM
- 0
Linux version of Akira ransomware targets VMware ESXi servers

The Akira ransomware operation uses a Linux encryptor to encrypt VMware ESXi virtual machines in double-extortion attacks against companies worldwide.
- Bill Toulas
- June 28, 2023
- 02:51 PM
- 0
Chinese hackers used VMware ESXi zero-day to backdoor VMs

VMware patched today a VMware ESXi zero-day vulnerability exploited by a Chinese-sponsored hacking group to backdoor Windows and Linux virtual machines and steal data.
- Sergiu Gatlan
- June 13, 2023
- 12:48 PM
- 0
New Buhti ransomware gang uses leaked Windows, Linux encryptors

A new ransomware operation named 'Buhti' uses the leaked code of the LockBit and Babuk ransomware families to target Windows and Linux systems, respectively.
- Bill Toulas
- May 25, 2023
- 06:00 AM
- 1
Babuk code used by 9 ransomware gangs to encrypt VMWare ESXi servers

An increasing number of ransomware operations are adopting the leaked Babuk ransomware source code to create Linux encryptors targeting VMware ESXi servers.
- Sergiu Gatlan
- May 11, 2023
- 02:04 PM
- 0
Linux version of RTM Locker ransomware targets VMware ESXi servers

RTM Locker is the latest enterprise-targeting ransomware operation found to be deploying a Linux encryptor that targets virtual machines on VMware ESXi servers.
- Bill Toulas
- April 27, 2023
- 12:20 PM
- 1