New ESXiArgs ransomware version prevents VMware ESXi recovery

[penfold]

Hope this doesn't impact anyone, but worth checking your version of ESXi

 

https://www.bleepingcomputer.com/news/security/new-esxiargs-ransomware-version-prevents-vmware-esxi-recovery/

[RLR]

This sounds a bit different to the one reported at the begining of the week as the fix was to disable SLP and/or update to a later version. This article suggests SLP was disabled but still got infected. Might have missed it but this article doesn't say what the cause is or how to fix it?

[CHiLL]

"Internet-exposed VMware ESXi servers" - does that mean the hosts were accessible over the Internet (e.g, remote management), or that guest VMs were accessible (e.g, VPN server)?

[Jcx500]

"Internet-exposed VMware ESXi servers" - does that mean the hosts were accessible over the Internet (e.g, remote management), or that guest VMs were accessible (e.g, VPN server)?

 

Most likely means exposed vcenter’s or standalone hosts. Still baffles me why people do this