[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFdu8ozPgdvPJPJI-3QwJFPdbQBg9htfvw6gmwM06qrI":3,"$fiEPc4WlFAJjlhz_QYYdX11SsutUWab_zo93dp2U8hJA":87},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":84,"created_at":85,"updated_at":86,"published_at":61},"ransomexx-deploys-esxiargs-ransomware-against-vmware-esxi-hypervisors","RansomEXX deploys ESXiArgs ransomware against VMware ESXi hypervisors","NAKIVO details a new multiplatform ESXiArgs variant with a fresh wave of infections across France and other regions.","RansomEXX is running a new ESXiArgs ransomware campaign targeting VMware ESXi hypervisors, featuring a multiplatform variant and a fresh wave of infections across France and other regions.",[10,11,12,13,14],"RansomEXX","ESXiArgs","VMware ESXi","ransomware","NAKIVO","# RansomEXX deploys ESXiArgs ransomware against VMware ESXi hypervisors\n\n*NAKIVO details a new multiplatform ESXiArgs variant with a fresh wave of infections across France and other regions.*\n\n**Tags:** `RansomEXX` `ESXiArgs` `VMware ESXi` `ransomware` `NAKIVO`\n\n> RansomEXX is running a new ESXiArgs ransomware campaign targeting VMware ESXi hypervisors, featuring a multiplatform variant and a fresh wave of infections across France and other regions.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2023-22527 | 9.8 | 100.0% | ✅ listed | available | 89.5 (Critical) |\n| CVE-2024-55591 | 9.8 | 98.3% | ✅ listed | available | 89.88 (Critical) |\n| CVE-2024-0012 | 9.8 | 99.7% | ✅ listed | available | 85.83 (Critical) |\n| CVE-2024-24919 | 8.6 | 100.0% | ✅ listed | available | 80.83 (High) |\n| CVE-2025-29824 | 7.8 | 13.8% | ✅ listed | available | 78.17 (High) |\n\n## ESXiArgs ransomware campaign hits VMware ESXi hypervisors\n\nNAKIVO has detailed a new ransomware campaign dubbed ESXiArgs that targets VMware ESXi hypervisors, according to a blog post updated on April 28, 2026. The campaign is being run by the RansomEXX threat group, which has deployed a new multiplatform variant against ESXi hosts.\n\nThe campaign includes a fresh wave of infections observed across France and other regions, with the multiplatform variant handling the ESXi-specific payload. RansomEXX, which has been active since 2020 and runs on a ransomware-as-a-service model, is the same group behind the ESXiArgs deployment, extending its reach to the hypervisor layer where it can encrypt VMs at the ESXi level.\n\n## How the ESXiArgs variant works\n\nThe ESXiArgs variant is multiplatform, handling both Windows and Linux ESXi hypervisors in a single payload. RansomEXX’s Linux variant first appeared in late 2020, making it the first major Windows ransomware family to expand to the Linux kernel layer. That move let the group encrypt VMs directly on the ESXi host rather than relying on guest-level agents.\n\nFile encryption uses AES in ECB mode, with the key embedded in the payload and wrapped in RSA-4096. The RSA-encrypted AES key is what the operator drops onto the target before the bulk encryption pass runs, keeping the symmetric key out of the clear-text binary.\n\n## Who was hit in the fresh wave\n\nA fresh wave of RansomEXX infections is hitting VMware ESXi hypervisors across France and other regions, with the group deploying its multiplatform variant against the hypervisor layer. The campaign extends RansomEXX’s reach to the ESXi host, where it encrypts VMs directly rather than relying on guest-level agents.\n\nRansomEXX has a history of high-profile targets, including government agencies, manufacturers, and healthcare organizations. The group runs on a ransomware-as-a-service model and has been active since 2020, when it made a name for itself with widely reported attacks. It debuted as Defray777 in 2018 and was renamed after the string “ransom.exx” was found in its binary. The group also started a leak site in 2020 for publishing stolen data, which it has used to publish data from government agencies and other high-value victims.\n\n## RansomEXX's known tooling and tactics\n\nRansomEXX leans on trojanized legitimate tools to move fast and stay under the radar. The group’s initial access and lateral movement stack includes Vatet Loader, PyXie RAT, and TrickBot, all of which are dropped as modified copies of widely trusted binaries. This is a common pattern among modern ransomware operators, but it lets RansomEXX deploy payloads quickly while evading signature-based detection that would flag a raw Cobalt Strike beacon.\n\nPost-intrusion, the group brings Cobalt Strike and Metasploit for C2, privilege escalation, and payload staging. Cobalt Strike handles the main beacon and post-exploitation scripts, while Metasploit covers the remaining payloads and helper modules. The full set is part of the same arsenal linked to the Gold Dupont threat group, which has been running this stack since 2018.\n\nThe tell that sets RansomEXX apart is the hardcoded target name in the binary. The victim’s name is embedded directly in the executable, which means the operator tailors the payload to each chosen target before deployment. It’s a deliberate move that signals the attack was prepared for that specific victim, rather than a generic drop-and-encrypt run.\n\n## Key points\n\n- NAKIVO blog (updated April 28, 2026) details a new ESXiArgs ransomware campaign hitting VMware ESXi hypervisors.\n- The campaign includes a multiplatform variant and a fresh wave of infections across France and other regions.\n- RansomEXX is a RaaS group active since 2020, linked to Gold Dupont, with Windows and Linux variants and a dedicated leak site.\n- The group uses trojanized tools including Vatet Loader, PyXie RAT, TrickBot, and Cobalt Strike, with the target name hardcoded in the binary.\n- Ransomware Tool Matrix (May 2025) confirms RansomEXX as an established group active for over a year, using CVE-2025-29824 (Windows CLFS) for local privilege escalation.\n\n## Further reading & sources\n\n- [Ransomware Spotlight: RansomEXX | Trend Micro (US)](https:\u002F\u002Ftrendmicro.com\u002Fvinfo\u002Fus\u002Fsecurity\u002Fnews\u002Fransomware-spotlight\u002Fransomware-spotlight-ransomexx)\n- [Ransomware Tool Matrix Project Updates: May 2025](https:\u002F\u002Fblog.bushidotoken.net\u002F2025\u002F05\u002Fransomware-tool-matrix-project-updates.html)\n- [Ransomexx · RansomLook](https:\u002F\u002Fransomlook.io\u002Fgroup\u002Fransomexx)\n- [RansomEXX Ransomware: Analysis, Detection, and Mitigation](https:\u002F\u002Fsentinelone.com\u002Fanthology\u002Fransomexx)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fransomexx-deploys-esxiargs-ransomware-against-vmware-esxi-hypervisors.png?v=3aea353c27",{"cves":18,"iocs":50,"actors":57,"malware":63,"technologies":75},[19,28,33,39,44],{"id":20,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},"CVE-2023-22527",true,"\u002Fvulnerabilities\u002FCVE-2023-22527",9.8,0.9998,"Critical",89.5,"3.1",{"id":29,"kev":21,"poc":21,"url":30,"cvss":23,"epss":31,"risk_band":25,"risk_score":32,"cvss_version":27},"CVE-2024-0012","\u002Fvulnerabilities\u002FCVE-2024-0012",0.9986,85.83,{"id":34,"kev":21,"poc":21,"url":35,"cvss":36,"epss":24,"risk_band":37,"risk_score":38,"cvss_version":27},"CVE-2024-24919","\u002Fvulnerabilities\u002FCVE-2024-24919",8.6,"High",80.83,{"id":40,"kev":21,"poc":21,"url":41,"cvss":23,"epss":42,"risk_band":25,"risk_score":43,"cvss_version":27},"CVE-2024-55591","\u002Fvulnerabilities\u002FCVE-2024-55591",0.9415,89.88,{"id":45,"kev":21,"poc":21,"url":46,"cvss":47,"epss":48,"risk_band":37,"risk_score":49,"cvss_version":27},"CVE-2025-29824","\u002Fvulnerabilities\u002FCVE-2025-29824",7.8,0.139,78.17,[51,54],{"type":52,"value":53},"other","ransom.exx",{"type":55,"value":56},"domain","trendmicro.com",[58],{"url":59,"name":10,"slug":60,"type":13,"origin":61,"motivation":62},"\u002Fthreat-groups\u002Fransomexx","ransomexx",null,"financial",[64,65,67,69,71,73],{"name":10},{"name":66},"TrickBot",{"name":68},"Cobalt Strike",{"name":70},"PyXie RAT",{"name":72},"Vatet Loader",{"name":74},"Metasploit",[76,79,81,83],{"vendor":77,"product":78},"Microsoft","Windows",{"vendor":77,"product":80},"Linux",{"vendor":77,"product":82},"Windows CLFS",{"vendor":80,"product":80},"ransomware_incident","2026-08-28T07:09:31.344646+00:00","2026-10-16T12:29:11.486175+00:00",{"articles":88},[89,101,113,124],{"slug":90,"title":91,"summary":92,"tags":93,"hero_image_url":99,"story_type":84,"created_at":100},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[13,94,95,96,97,98],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","2026-09-26T07:06:42.867972+00:00",{"slug":102,"title":103,"summary":104,"tags":105,"hero_image_url":111,"story_type":84,"created_at":112},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[106,107,108,109,110,13],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":114,"title":115,"summary":116,"tags":117,"hero_image_url":122,"story_type":84,"created_at":123},"dark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys","Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.","Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.",[118,119,13,120,121],"Dark Project","Brainhunter","double extortion","ransomware.live","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys.png?v=d6c0e0a4ac","2026-09-21T07:02:16.98855+00:00",{"slug":125,"title":126,"summary":127,"tags":128,"hero_image_url":133,"story_type":84,"created_at":134},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.",[13,129,130,131,132],"data-exfiltration","coinbasecartel","dark-web","extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00"]