# MA-908.022023: MyCERT Advisory - Ransomware campaign actively exploiting a vulnerability (CVE-2021-21974) in unpatched VMware ESXi servers

**Date:** 17 Feb 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-908.022023  
**Advisory ID:** MA-908.022023

---

**1.0 Introduction**
CISA has released a recovery script for organization that have fallen victim to ESXiArgs ransomware.
**2.0 Impact**
The ESXiArgs ransomware encrypts configuration files on vulnerable ESXi servers, potentially rendering virtual machines (VMs) unusable.
**3.0 Affected Products**
- VMware ESXi
- VMware Workstation Pro / Player (Workstation)
- VMware Fusion Pro / Fusion (Fusion)
- VMware Cloud Foundation
- VMware vRealize Network Insight (vRNI)
**4.0 Recommendations**
MyCERT recommends user, administrators and organizations impacted by EXSiArgs evaluate the scripts and guidance provided in the accompanying README file to determine if it is fit for attempting to recover access to files in their environment.
Organizations can access the recovery scripts by referring link below:
- <https://github.com/cisagov/ESXiArgs-Recover>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.cisa.gov/uscert/ncas/current-activity/2023/02/07/cisa-releases-esxiargs-ransomware-recovery-script>
- <https://github.com/cisagov/ESXiArgs-Recover>
- <https://www.mycert.org.my/portal/advisory?id=MA-902.122022>
- <https://www.mycert.org.my/portal/advisory?id=MA-881.102022>
- <https://www.mycert.org.my/portal/advisory?id=MA-868.092022>
- <https://www.mycert.org.my/portal/advisory?id=MA-852.082022>