Since it is not the only initial access vector, some organizations that have patched their vulnerable ESXi servers or disabled SLP service can still get infected with ESXiArgs ransomware.Īlthough not all initial access methods are known, victim statistics indicate that over 3,800 servers in France, Germany, the US, Canada, and the Netherlands were infected. Įven though this vulnerability was disclosed two years ago and had a CVSS score of 9.8 (Critical), some organizations still run outdated or unpatched ESXi versions, which makes them potential targets for these attacks. On February 8, 2023, CISA, FBI, and CERT-FR published security advisories on ESXiArgs ransomware that exploits known a vulnerability, CVE-2021-21972, in VMware ESXi software with publicly facing ESXi hypervisors. ESXi Args Ransomware (CISA Alert AA23-039A) Simulate Emerging Cyber Threats with 14-Day Free Trial of the Picus Platform Top Cyber Threats of February 2023ĮSXi Args Ransomware (CISA Alert AA23-039A)Įarth Kitsune Malware (WhiskerSpy Backdoor)ġ.

You can easily simulate these threats and validate and improve your security controls against them with the Picus Complete Security Validation Platform. This blog briefly explains the top four cyber threats observed in February 2023.

Luckily, Picus Labs quickly responded by adding attack simulations for these emerging threats to the Picus Threat Library. February was another challenging month for cybersecurity, with new malware families, ransomware campaigns, and even a zero-day vulnerability making their way onto the scene.

Bitdefender 6 month trial