Loading story…
HostDZire disclosed a major security incident after a ransomware attack hit multiple VMware ESXi virtualization nodes in its hosting environment, disrupting customer services running on the affected infrastructure. The provider said the incident impacted its VMware-based virtualization platform and caused outages across hosted workloads tied to those nodes.
According to the company’s notice and subsequent reporting, the initial intrusion was most likely linked to exploitation of a recently disclosed VMware security vulnerability, although forensic investigation was still ongoing and the threat actor had not been identified. HostDZire described the event as a critical service incident affecting its VMware infrastructure, indicating that recovery and incident-response efforts were underway.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
HostDZire published an incident notice stating that a major security incident affected its virtualization infrastructure. The company said a ransomware attack hit multiple VMware ESXi nodes, disrupting hosted services, and that an ongoing forensic investigation was assessing a recently disclosed VMware vulnerability as the likely initial access vector.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale **ESXiArgs** ransomware campaign hit internet-exposed VMware ESXi servers by exploiting a long-known vulnerability in the OpenSLP service, with incident responders and national authorities warning that many affected systems had not applied available patches. CERT-FR issued an alert on active exploitation affecting VMware ESXi, while broad reporting described widespread compromises across organizations globally as attackers encrypted virtual machine files and dropped ransom notes on hypervisors. VMware said the attacks did **not** stem from a newly discovered zero-day, but from exploitation of older, already patched weaknesses and insecurely exposed services on unsupported or unpatched ESXi versions. The incident renewed scrutiny of VMware security after earlier warnings that threat actors, including state-backed operators, had abused VMware flaws such as `CVE-2020-4006` for initial access, persistence, and privileged movement inside enterprise environments, underscoring the risk posed by internet-facing virtualization infrastructure that lags on patching and hardening.
Sep 3, 2026
Ransomware operators are exploiting **CVE-2026-59310**, a critical unauthenticated VMware vCenter Server flaw in the Syslog server, to compromise vCenter management infrastructure and encrypt managed ESXi virtual machines with Babuk-derived payloads. Broadcom patched the vulnerability on July 29, but successful exploitation was observed within five days; reported activity affected 361 victim IP addresses across 47 countries. No ransomware group has been publicly identified. Initial intrusions used reverse-SSH tunnels and cron-job persistence, activity assessed as likely associated with an advanced persistent threat actor before ransomware deployment emerged. CISA has added the 9.8-CVSS vulnerability to its Known Exploited Vulnerabilities catalog and warned of ransomware use. Organizations should urgently install VMware's latest cumulative updates, remove vCenter interfaces from direct internet exposure, limit administration to trusted networks and jump hosts, and investigate formerly exposed or unpatched vCenter instances for persistence and unauthorized access.
Sep 17, 2026
Security researchers have reported a dramatic increase in ransomware attacks targeting hypervisors, with Huntress data showing that the proportion of ransomware incidents involving hypervisors jumped from 3% in the first half of 2025 to 25% in the second half. The Akira ransomware group has been identified as the primary actor behind this trend, exploiting the limited visibility and security controls typically present on hypervisors to bypass traditional endpoint and network defenses. Attackers are leveraging built-in tools such as OpenSSL to encrypt virtual machine volumes directly from the hypervisor, allowing them to impact dozens or hundreds of VMs simultaneously and avoid detection by endpoint security solutions. This shift in tactics underscores the critical need for organizations to harden their hypervisor infrastructure with the same rigor as endpoints and servers. Security experts recommend measures such as patching, strict access control, runtime hardening, and robust backup and recovery strategies to mitigate the risk. The trend highlights that as defenders improve endpoint security, adversaries are increasingly targeting the foundational layers of virtualized environments, making hypervisor security a top priority for organizations relying on virtualization technologies like ESXi.
Jun 29, 2026