ESXi Ransomware: Trends, Logging, and Detection | Threat SnapShot 

Since 2021, ransomware groups have set their sights on VMware ESXi hypervisors, with the SEXi variant, emerging in 2024, being the most recent threat. The Babuk Locker was one of the first to target ESXi, and its leaked source code enabled other strains like ESXiArgs, BlackBasta, and Clop to develop customized variants terminating VMs and encrypting data on ESXi servers. While employing similar tactics like exploiting vulnerabilities and encrypting VM files, these ESXi-focused ransomware exhibit patterns that provide detection opportunities across the board. By analyzing past attacks, we can better prepare for future threats targeting our virtualization environments. Join the SnapAttack community to access in-depth detection content covered in this video and stay ahead of evolving ransomware targeting ESXi.
✅ Subscribe to SnapAttack for more in-depth analyses and real-world applications of cybersecurity defenses.
📢 Have questions or topics you’d like us to cover? Drop a comment below!
👋 Follow us:
/ snapattack
/ snapattackhq
/ ajkingio
/ ajkingio
SnapAttack Resources:
- app.snapattack... - Collection: ESXi Ransomware: Trends, Logging, and Detection | Threat SnapShot
References:
- docs.vmware.co...
- docs.vmware.co...
- detect.fyi/det...
- www.recordedfu...
- blogs.juniper....
- www.bleepingco...
- www.uptycs.com...
- www.trendmicro...
- www.darkreadin...
- heimdalsecurit...
- / the-new-sexi-ransomwar...
- blogs.vmware.c...
- blogs.vmware.c...
- www.fortinet.c...
- ransomware.org...
- www.uptycs.com...
- www.malwarebyt...
- trustedsec.com...
- www.trellix.co...
- censys.com/the...
- www.cisa.gov/n...
- blogs.blackber...
- www.cybersecur...
- www.cisa.gov/n...
- readwise.io/re...
- www.forescout....
- www.kaspersky....
- www.mandiant.c...
- www.crowdstrik...
- www.crowdstrik...