Quick Answer — In early February 2023, a ransomware family dubbed ESXiArgs swept the internet, encrypting thousands of VMware ESXi hypervisors — estimates ran from ~2,000 to nearly 4,000 victims across 100+ countries in the first week. The entry path wasn’t a new exploit: attackers chained known OpenSLP vulnerabilities (CVE-2021-21974 and friends) on unpatched, SLP-enabled hosts, or simply walked in where exposure met weak hygiene. The lesson: the hypervisor is the vault — one encryption event there is a whole-estate outage — and internet-facing SLP should not exist in 2023.
What happened
- The target: VMware ESXi — the bare-metal hypervisor consolidating most of the world’s virtualized servers. Encrypting ESXi means encrypting every VM’s datastore simultaneously: file servers, databases, domain controllers, all of it.
- The vector: Primarily CVE-2021-21974, a heap overflow in the OpenSLP service (used for service discovery on LANs), plus opportunistic access to hosts with SLP enabled and exposed. VMware had patched in 2021; ESXi 7.0U3+ even shipped SLP disabled by default — but huge fleets of 6.5/6.7/7.0 builds still ran it on.
- The payload: “ESXiArgs”-style encryptors targeted /etc and /vmfs/volumes — VM configuration and virtual disks — appending extensions (e.g., .vesh and .args-style variants), dropping ransom notes, and leaving the hypervisor shell half-alive with a partial encryption of flat VMDKs. Ransom notes (per published samples) demanded mid-five-to-six-figure sums influenced by estate size.
- The spread: Shodan-style scanning showed victims clustered in France, Germany, Italy, the US, and Canada — datacenters, universities, hospitals’ non-clinical estates, SMBs.
Why hypervisor ransomware is category-5
| Property | Consequence |
|---|---|
| One encryption event = all VMs | Every workload’s storage corrupted at once |
| Host-level patch cadence slow | ESXi upgrades are maintenance-window events; fleets drift years behind |
| Legacy services (SLP) on by default in old builds | Forgotten daemons become the front door |
| Thin recovery tooling on host | Few EDR/visibility options; attackers know dwell time is cheap |
| Management networks often flat | One foothold in a management VLAN reaches every host |
The TTP pattern
- Recon for exposed SLP (427/udp-style service ports) and older builds; exploit or abuse open management.
- Deploy Linux ELF encryptor to the host; modify config files to mark encryption; leave a portion of small files intact to keep host bootable.
- Ransom note per datastore; contact emails; negotiable demands per reporting on notes.
- Some victims found partial encryption (flat files’ extents), which enabled the community’s later decryption workarounds.
Timeline
| Date | Event |
|---|---|
| 2023-02-03 → 05 | Mass-encryption wave detected; CISA/FBI and national CERTs (Italy’s ACN first among vocal) issue advisories |
| 2023-02-06 → 10 | Victim counts plateau ~2–4k; researchers confirm OpenSLP chaining; VMware re-issues guidance to disable SLP |
| 2023-02-09(ish) | CISA adds recovery script to GitHub; a French researcher’s workaround restores some victims by rebuilding VM metadata from unencrypted small files |
| 2023-02 → 04 | Second-wave variants tweak encryption to defeat recovery scripts; patch-gap scanning continues for months |
| 2023 → 2026 | ESXi becomes a standing ransomware target class (later: Akira/BlackBasta-era hits on ESXi via stolen vCenter creds) |
Defensive actions that actually mattered
- Disable SLP. Stop and disable the OpenSLP-based service per VMware’s guidance (the KB 76372 checklist became the reference) and firewall SLP everywhere it isn’t needed.
- Patch hypervisors like browsers. The exploited bug was 18 months old with a patch available; fleet drift, not novelty, caused the wave.
- Segment management networks. SLP belongs on carefully scoped LANs, never routed to hostile nets; vMotion/management VLAN separation limits blast radius.
- Back up hosts AND guests, immutably. VMFS-level encryption defeats guest-snapshot-only strategies where datastores aren’t separately protected; immutable/snapshot-locked copies do.
- Rehearse host rebuild. Speed of re-imaging ESXi + restoring VMs— not negotiation — decided who was down for days versus weeks.
Why it still matters in 2026
ESXiArgs set the template for the modern hypervisor-targeting ransomware era: since then, crews have returned to ESXi repeatedly — via stolen vSphere credentials, leased access, and edge-box pivots — because the yield-per-touch is unmatched: one host equals one datacenter. In 2026’s landscape (CISA-KEV pressure, NIS2 obligations, virtualization-stack sprawl), the control set that blunts this class is boring and known: no legacy daemons, management-plane isolation, immutable backups, rebuild drills. The February 2023 wave’s cruelest datapoint stands as the summary: every single victim owned a patch that had existed for a year and a half — the attack surface didn’t need to exist either.
Did victims recover without paying?
Many did, partially or fully. Because several ESXiArgs samples encrypted only portions of large flat files (a speed optimization), metadata and small files often survived intact — enough for CISA’s recovery script and community tooling to reconstruct bootable VMs on a meaningful subset of hosts. Variants later encrypted more thoroughly, closing that door; the recovery window existed for weeks only.
Wasn’t there also CVE-2023-20867 or other 2023 ESXi bugs involved?
Adjacent but distinct: ESXiArgs’ initial wave chained the older OpenSLP issues (2021-era). Other 2023 ESXi vulnerabilities (the backdoored-ESXi supply-chain scare of early 2023, separate auth-bypass bugs) surfaced around the same period and blur together in retellings — but the mass-encryption wave itself maps to SLP enablement plus patch debt, per incident-response consensus.
Why did so many run SLP exposed anyway?
Defaults and drift: SLP shipped enabled on older builds for LAN discovery use cases, and hypervisor change management is the slowest realm in IT — upgrades risk downtime, so hosts run for years on install-day state. Attackers’ scanners mapped that reality faster than asset inventories did; the wave was drift exploitation at internet scale.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
