Attackers are exploiting ESXi servers worldwide to deploy ransomware. They seem to be abusing CVE-2021-21974 to gain initial access to the ESXi server, which provide them the ability to remotely execute code (RCE) on the exploited system. Once the malware gained access to the vulnerable server, it tries to shut down the virtual machine (VM) by killing the VMX process. Once the VM has been shut down, the malware tries to encrypt the virtual machine files. Be aware that the malware is not always capable to completely shut down the VM, which can result in certain virtual machine files being locked. The locked files are then unable to be encrypted by the malware.

It is very important to perform a full system analysis if you are running a vulnerable version of ESXi, since the the attacker can drop malicious code on your system which can still be executed after updating the ESXi server. The mitigations listed below only fix the initial access vector for the attack, but do not prevent an attacker from running malicious code on a patched ESXi server.