IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

ESXi ransomware campaign strikes Florida Supreme Court, worldwide universities

Threat actors show no sign of stopping following the widespread exploitation of the two-year-old vulnerability in VMware ESXi servers

Florida’s Supreme Court is the latest high-profile target in the ongoing ransomware campaign targeting unpatched WMware ESXi servers.

A host of US and EU-based academic institutions are also among those that have been affected by attacks, according to reports from Reuters.  

A spokesperson for the Florida Supreme Court told the publication that infrastructure affected in the attack was used to support elements of the Florida state court system.

However, they insisted that this was “segregated” from the Supreme Court’s main networks and as such the integrity of the state court system has not been compromised.  

“Florida Supreme Court’s network and data are secure,” the spokesperson said.

The extent of the damage caused by ransomware attacks on academic institutions, which are believed to be based in Hungary, Slovakia, and the US states of Texas and Georgia, is yet to be fully realised.  

These incidents represent just a few in a growing list of organisations worldwide that have been affected by the spread of ESXiArgs ransomware.  

Data compiled by the crowdsourced Ransomwhere project - which tracks ransomware payments made worldwide - and collected from Censys and Shodan, revealed that, so far, more than 2,800 organisations have been impacted by the ongoing attacks.

Despite this, Ransomwhere's analysis found that only $88,000 had been successfully extorted by cyber criminals from a total of four completed payments.

Given that the attacks only started in the last couple of days, it's likely that future attacks will also lead to additional payments being made.

Xavier Bellekens, CEO of Lupovis, said attackers behind this escalating campaign appear to have used “automated tests” to identify vulnerable ESXi servers and exploit vulnerabilities to launch the ESXiArgs ransomware.  

“Over the course of the weekend, Lupovis has seen numerous new IPs scanning and exploiting the vulnerability, with attackers acting quick to catch organisations out before they have time to apply the patch.” 

ESXi attacks come as no surprise

Hundreds of organisations were targeted in the wake of the vulnerability disclosure. However, the situation appears to be escalating further and recent attacks could represent the just tip of the iceberg, according to security experts.

Related Resource

PowerEdge - Cyber resilient infrastructure for a Zero Trust world

Combat threats with an in-depth security stance

Whitepaper cover with title in a blue colour block circle. with images of digital locksFree Download

John Fokker, head of threat intelligence at Trellix, said the spate of attacks in recent days should come as no surprise given the sheer volume of organisations that could be targeted by threat actors.

“The VMware ESXi server vulnerabilities had already been leveraged by threat actors for years and it was only a matter of time before a major attack was executed,” he said.  

Fokker added that Trellix's analysis of the incident shows that the “scale and distribution of the machine detections are truly global in nature and across most verticals”.

“It’s probable that organisations hadn’t applied last year’s patch and were unaware they were running a vulnerable system which left them open to attack,” he noted. 

Mitigating threats 

In response to the ESXiArgs ransomware campaign, the US Cybersecurity and Infrastructure Agency (CISA), released a script to recover servers impacted by attacks.  

The ESXiArgs-Recover script, which can be found on GitHub, enables affected businesses to automate the recovery process, and was compiled based on publicly available resources, including a tutorial by Enes Sonmez and Ahmet Aykac, CISA said.  

“This tool works by reconstructing virtual machine metadata from virtual disks that were not encrypted by the malware,” the agency said.  

CISA added that it is aware that “some organisations have reported success in recovering files without paying ransoms”. 

Featured Resources

IT best practices for accelerating the journey to carbon neutrality

Considerations and pragmatic solutions for IT executives driving sustainable IT

Free Download

The Total Economic Impact™ of IBM Spectrum Virtualize

Cost savings and business benefits enabled by storage built with IBMSpectrum Virtualize

Free download

Using application migration and modernisation to supercharge business agility and resiliency

Modernisation can propel your digital transformation to the next generation

Free Download

The strategic CFO

Why finance transformation propels business value

Free Download


Ransomware now strikes one in 40 organisations per week, Check Point finds

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022

Most Popular

HMRC lost nearly 50% more devices in 2022

HMRC lost nearly 50% more devices in 2022

17 Mar 2023
The big PSTN switch off: What’s happening between now and 2025?

The big PSTN switch off: What’s happening between now and 2025?

13 Mar 2023
Outlook zero day patch causes headaches for Windows admins

Outlook zero day patch causes headaches for Windows admins

15 Mar 2023