ESXi ransomware campaign strikes Florida Supreme Court, worldwide universities
Threat actors show no sign of stopping following the widespread exploitation of the two-year-old vulnerability in VMware ESXi servers


Florida’s Supreme Court is the latest high-profile target in the ongoing ransomware campaign targeting unpatched WMware ESXi servers.
A host of US and EU-based academic institutions are also among those that have been affected by attacks, according to reports from Reuters.
A spokesperson for the Florida Supreme Court told the publication that infrastructure affected in the attack was used to support elements of the Florida state court system.
However, they insisted that this was “segregated” from the Supreme Court’s main networks and as such the integrity of the state court system has not been compromised.
“Florida Supreme Court’s network and data are secure,” the spokesperson said.
The extent of the damage caused by ransomware attacks on academic institutions, which are believed to be based in Hungary, Slovakia, and the US states of Texas and Georgia, is yet to be fully realised.
These incidents represent just a few in a growing list of organisations worldwide that have been affected by the spread of ESXiArgs ransomware.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Data compiled by the crowdsourced Ransomwhere project - which tracks ransomware payments made worldwide - and collected from Censys and Shodan, revealed that, so far, more than 2,800 organisations have been impacted by the ongoing attacks.
Despite this, Ransomwhere's analysis found that only $88,000 had been successfully extorted by cyber criminals from a total of four completed payments.
Given that the attacks only started in the last couple of days, it's likely that future attacks will also lead to additional payments being made.
Xavier Bellekens, CEO of Lupovis, said attackers behind this escalating campaign appear to have used “automated tests” to identify vulnerable ESXi servers and exploit vulnerabilities to launch the ESXiArgs ransomware.
“Over the course of the weekend, Lupovis has seen numerous new IPs scanning and exploiting the vulnerability, with attackers acting quick to catch organisations out before they have time to apply the patch.”
ESXi attacks come as no surprise
Hundreds of organisations were targeted in the wake of the vulnerability disclosure. However, the situation appears to be escalating further and recent attacks could represent the just tip of the iceberg, according to security experts.
RELATED RESOURCE
PowerEdge - Cyber resilient infrastructure for a Zero Trust world
Combat threats with an in-depth security stance
John Fokker, head of threat intelligence at Trellix, said the spate of attacks in recent days should come as no surprise given the sheer volume of organisations that could be targeted by threat actors.
“The VMware ESXi server vulnerabilities had already been leveraged by threat actors for years and it was only a matter of time before a major attack was executed,” he said.
Fokker added that Trellix's analysis of the incident shows that the “scale and distribution of the machine detections are truly global in nature and across most verticals”.
“It’s probable that organisations hadn’t applied last year’s patch and were unaware they were running a vulnerable system which left them open to attack,” he noted.
Mitigating threats
In response to the ESXiArgs ransomware campaign, the US Cybersecurity and Infrastructure Agency (CISA), released a script to recover servers impacted by attacks.
The ESXiArgs-Recover script, which can be found on GitHub, enables affected businesses to automate the recovery process, and was compiled based on publicly available resources, including a tutorial by Enes Sonmez and Ahmet Aykac, CISA said.
“This tool works by reconstructing virtual machine metadata from virtual disks that were not encrypted by the malware,” the agency said.
CISA added that it is aware that “some organisations have reported success in recovering files without paying ransoms”.

Ross Kelly is ITPro's News & Analysis Editor, responsible for leading the brand's news output and in-depth reporting on the latest stories from across the business technology landscape. Ross was previously a Staff Writer, during which time he developed a keen interest in cyber security, business leadership, and emerging technologies.
He graduated from Edinburgh Napier University in 2016 with a BA (Hons) in Journalism, and joined ITPro in 2022 after four years working in technology conference research.
For news pitches, you can contact Ross at ross.kelly@futurenet.com, or on Twitter and LinkedIn.
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs