Ransomware

esxiargs

Follow this group

E-mail alert on newly attributed CVEs, new victims in Brazil and verified incidents.

About the group

ESXiArgs is a ransomware campaign that emerged in February 2023, targeting VMware ESXi servers by exploiting the CVE-2021-21974 vulnerability. It encrypts virtual machine configuration files (.vmdk, .vmx, .vmxf, .vmsd, .vmsn, .vswp, .vmss, .nvram, .vmem) rendering VMs inaccessible. The campaign compromised thousands of unpatched servers globally, primarily affecting European organizations. A decryptor was later released by CISA and FBI.

Exploited vulnerabilities 1

CVEs this group is known to exploit, with the source and confidence of each next to it. Ordered by confidence and real-world severity.

CVE-2021-21974HIGHEPSS 45% group leak site

Ransom notes 1

The text the group leaves on attacked machines, from a public ransom-note collection.

How to Restore Your Files.html · 2 contact(s) masked
How to Restore Your Files 
 
 

 How to Restore Your Files


 Security Alert!!! 

 We hacked your company successfully

 All files have been stolen and encrypted by us

 If you want to restore files or avoid file leaks, please send 2.0781 bitcoins to the wallet [bitcoin wallet] 

 If money is received, encryption key will be available on TOX_ID: [Tox ID] 


 Attention!!! 

 Send money within 3 days, otherwise we will expose some data and raise the price

 Don't try to decrypt important files, it may damage your files

 Don't trust who can decrypt, they are liars, no one can decrypt without key file

 If you don't send bitcoins, we will notify your customers of the data breach by email and text message

 And sell your data to your opponents or criminals, data may be made release


 Note 

 SSH is turned on

 Firewall is disabled
Available on the SOC, MSSP and Enterprise plans

Here, the criminals' contacts in the notes are masked.

These plans unlock the raw intelligence that stays closed on the site:

  • the addresses of the groups' leak and negotiation sites;
  • the victims' names;
  • the full negotiation chat;
  • each group's YARA rules and full detection package;
  • the criminals' contacts (email, .onion, Tox) unmasked.

They also include webhook, Slack and Discord alerts, the MCP for AI assistants and more API volume. Enterprise is by request.

See the plans

Source: public ransom-note collection · updated on 12 Nov 2026

Detection 3

The package a security team uses to hunt for the group in its own environment: the indicators (IOCs) and the YARA rules, from open intelligence on the group.

2 indicator(s) are only in the full package: the criminals' contacts (email, Tox, Session, Telegram, PGP), .onion addresses, FTP servers and wallets.

YARA rules 1 rule(s)

esxiargs.yar

Available on the SOC, MSSP and Enterprise plans

Here, the YARA rules and the full package download (with every indicator) are closed.

These plans unlock the raw intelligence that stays closed on the site:

  • the addresses of the groups' leak and negotiation sites;
  • the victims' names;
  • the full negotiation chat;
  • each group's YARA rules and full detection package;
  • the criminals' contacts (email, .onion, Tox) unmasked.

They also include webhook, Slack and Discord alerts, the MCP for AI assistants and more API volume. Enterprise is by request.

See the plans

Defensive content: use it only in environments you are authorized to analyze. Source: open intelligence on the group · updated on 13 Nov 2026

esxiargs uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →