Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2023-22527 | 9.8 | 100.0% | ✅ listed | available | 89.5 (Critical) |
| CVE-2024-55591 | 9.8 | 98.3% | ✅ listed | available | 89.88 (Critical) |
| CVE-2024-0012 | 9.8 | 99.7% | ✅ listed | available | 85.83 (Critical) |
| CVE-2024-24919 | 8.6 | 100.0% | ✅ listed | available | 80.83 (High) |
| CVE-2025-29824 | 7.8 | 13.8% | ✅ listed | available | 78.17 (High) |
ESXiArgs ransomware campaign hits VMware ESXi hypervisors
NAKIVO has detailed a new ransomware campaign dubbed ESXiArgs that targets VMware ESXi hypervisors, according to a blog post updated on April 28, 2026. The campaign is being run by the RansomEXX threat group, which has deployed a new multiplatform variant against ESXi hosts.
The campaign includes a fresh wave of infections observed across France and other regions, with the multiplatform variant handling the ESXi-specific payload. RansomEXX, which has been active since 2020 and runs on a ransomware-as-a-service model, is the same group behind the ESXiArgs deployment, extending its reach to the hypervisor layer where it can encrypt VMs at the ESXi level.
How the ESXiArgs variant works
The ESXiArgs variant is multiplatform, handling both Windows and Linux ESXi hypervisors in a single payload. RansomEXX’s Linux variant first appeared in late 2020, making it the first major Windows ransomware family to expand to the Linux kernel layer. That move let the group encrypt VMs directly on the ESXi host rather than relying on guest-level agents.
File encryption uses AES in ECB mode, with the key embedded in the payload and wrapped in RSA-4096. The RSA-encrypted AES key is what the operator drops onto the target before the bulk encryption pass runs, keeping the symmetric key out of the clear-text binary.
Who was hit in the fresh wave
A fresh wave of RansomEXX infections is hitting VMware ESXi hypervisors across France and other regions, with the group deploying its multiplatform variant against the hypervisor layer. The campaign extends RansomEXX’s reach to the ESXi host, where it encrypts VMs directly rather than relying on guest-level agents.
RansomEXX has a history of high-profile targets, including government agencies, manufacturers, and healthcare organizations. The group runs on a ransomware-as-a-service model and has been active since 2020, when it made a name for itself with widely reported attacks. It debuted as Defray777 in 2018 and was renamed after the string “ransom.exx” was found in its binary. The group also started a leak site in 2020 for publishing stolen data, which it has used to publish data from government agencies and other high-value victims.
RansomEXX's known tooling and tactics
RansomEXX leans on trojanized legitimate tools to move fast and stay under the radar. The group’s initial access and lateral movement stack includes Vatet Loader, PyXie RAT, and TrickBot, all of which are dropped as modified copies of widely trusted binaries. This is a common pattern among modern ransomware operators, but it lets RansomEXX deploy payloads quickly while evading signature-based detection that would flag a raw Cobalt Strike beacon.
Post-intrusion, the group brings Cobalt Strike and Metasploit for C2, privilege escalation, and payload staging. Cobalt Strike handles the main beacon and post-exploitation scripts, while Metasploit covers the remaining payloads and helper modules. The full set is part of the same arsenal linked to the Gold Dupont threat group, which has been running this stack since 2018.
The tell that sets RansomEXX apart is the hardcoded target name in the binary. The victim’s name is embedded directly in the executable, which means the operator tailors the payload to each chosen target before deployment. It’s a deliberate move that signals the attack was prepared for that specific victim, rather than a generic drop-and-encrypt run.
Key points
- NAKIVO blog (updated April 28, 2026) details a new ESXiArgs ransomware campaign hitting VMware ESXi hypervisors.
- The campaign includes a multiplatform variant and a fresh wave of infections across France and other regions.
- RansomEXX is a RaaS group active since 2020, linked to Gold Dupont, with Windows and Linux variants and a dedicated leak site.
- The group uses trojanized tools including Vatet Loader, PyXie RAT, TrickBot, and Cobalt Strike, with the target name hardcoded in the binary.
- Ransomware Tool Matrix (May 2025) confirms RansomEXX as an established group active for over a year, using CVE-2025-29824 (Windows CLFS) for local privilege escalation.