ESXi and Linux Ransomware: Encrypting the Hypervisor to Take Down Everything

ESXi and Linux ransomware is a class of ransomware with encryptors aimed at VMware ESXi hypervisors and Linux servers. ESXi is a high-value target because one compromised host stores the virtual disks of many virtual machines — encrypting at the hypervisor layer disables dozens of servers at once, often where endpoint detection cannot run. Most major Windows ransomware brands now ship ESXi lockers, and dedicated campaigns like ESXiArgs have hit thousands of exposed hosts.

How ESXi Lockers Work

ESXi encryptors enumerate running VMs and force-stop them with native admin binaries (esxcli, vim-cmd) to free the locked virtual-disk files, then encrypt. Play’s Linux variant checks for an ESXi environment before powering off all VMs; RansomHub’s ESXi variant removes snapshots and uses strong modern ciphers. Common anti-recovery steps include deleting snapshots and disabling ESXi syslog to blind defenders. MITRE tracks hypervisor-CLI abuse as an official technique with Royal and Cheerscrypt among its procedure examples. T1059.012 T1486 T1490 T1562.001

Initial Access

• ESXiArgs (February 2023): a mass campaign against internet-exposed ESXi OpenSLP (CVE-2021-21974); a CISA/FBI advisory cited more than 3,800 compromised servers worldwide (a dated snapshot) — and, notably, CVE-2021-21974 was never added to CISA’s KEV catalogue despite the mass campaign. It encrypted VM configuration/metadata rather than the large flat virtual disks, which aided some recovery.
• CVE-2024-37085 — an ESXi Active Directory integration authentication bypass (patched by Broadcom in June 2024) — was abused after attackers already held domain-admin credentials; Microsoft tied exploitation to Akira and Black Basta deployments, and Shadowserver counted roughly 20,275 exposed instances in a July 2024 snapshot. CVE-2024-37085
• More commonly, intrusions use stolen valid credentials and lateral movement to vCenter/ESXi management, then enable SSH and deploy the encryptor. T1078

Families

ESXi/Linux lockers now ship with Akira, Black Basta, LockBit, Royal, RansomHub, Play, Babuk, Cheerscrypt/MONTI, HelloKitty, RansomEXX and Hive, among others — many derived from leaked Babuk or Conti-lineage code. Attribution of specific CVE exploitation to specific families is Microsoft’s or a vendor’s assessment and is treated as hedged.

Detection & Mitigation

• Patch ESXi and vCenter promptly (including CVE-2021-21974 and CVE-2024-37085); disable OpenSLP where not needed.
• Lock down the management plane: isolate ESXi/vCenter management, disable the ESXi Shell and SSH except during maintenance, enable lockdown mode, and enforce MFA on vCenter and AD.
• Alert on SSH enablement on hosts and on esxcli/vim-cmd VM-kill, snapshot-removal or firewall changes outside change windows; forward ESXi syslog off-host and alert when logging is disabled.
• Keep immutable, off-host backups of VMs and vCenter, test hypervisor-level restore, and monitor AD for recreation of a deleted “ESXi Admins” group.