U.S. CISA adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs·Mar 5, 06:09 UTC · Mar 5, 2025Exploit / PoC in the wildCVE-2024-50302CVE-2025-22225CVE-2025-22224+3 CVEs60
+20,000 internet-exposed VMware ESXi instances vulnerable to CVE-2024Security Affairs·Aug 1, 20:28 UTC · Aug 1, 2024Ransomware in the wildCVE-2024-3708560
45,654 VMware ESXi servers reached End of Life on Oct. 15Security Affairs·Oct 17, 07:01 UTC · Oct 17, 2022Ransomware57
CVE-2025-22225 in VMware ESXi now used in active ransomware attacksSecurity Affairs·Feb 4, 22:02 UTC · Feb 4, 2026Ransomware in the wildCVE-2025-22225CVE-2025-22226CVE-2025-2222460
Now Abyss Locker also targets VMware ESXi serversSecurity Affairs·Jul 29, 20:01 UTC · Jul 29, 2023Ransomware57
Crooks exploit VMWare ESXi flaws to encrypt disks of VMsSecurity Affairs·Feb 2, 10:21 UTC · Feb 2, 2021RansomwareCVE-2019-5544CVE-2020-399260
Experts uncovered novel Malware persistence within VMware ESXi HypervisorsSecurity Affairs·Jun 13, 20:17 UTC · Jun 13, 2023Malware155
New 'MichaelKors' Ransomware-as-a-Service Targeting Linux and VMware ESXi SystemsThe Hacker News·Jun 14, 13:32 UTC · Jun 14, 2023Ransomware in the wild60
New wave of ransomware attacks targeting VMware ESXi ServersSecurity Affairs·Feb 4, 13:11 UTC · Feb 4, 2023RansomwareCVE-2021-2197460
Zeodium pays up to $500,000 for VMware ESXi, Microsoft HyperSecurity Affairs·Mar 8, 09:09 UTC · Mar 8, 2019Exploit / PoC60
Italian ACN warns ransomware campaign targeting VMware ESXiSecurity Affairs·Feb 6, 08:23 UTC · Feb 6, 2023RansomwareCVE-2021-2197460
CISA adds VMware ESXi bug to its Known Exploited Vulnerabilities catalogSecurity Affairs·Jul 30, 21:08 UTC · Jul 30, 2024Exploit / PoC in the wildCVE-2024-3708560
China-linked APT UNC3886 used VMware ESXi ZeroSecurity Affairs·Jun 14, 08:44 UTC · Jun 14, 2023Exploit / PoCCVE-2023-2086760
A new Linux version of TargetCompany ransomware targets VMware ESXi environmentsSecurity Affairs·Jun 6, 17:58 UTC · Jun 6, 2024Ransomware57
Black Basta ransomware supports encrypting VMware ESXi serversSecurity Affairs·Jun 8, 07:55 UTC · Jun 8, 2022Ransomware57
HelloKitty ransomware now targets VMware ESXi serversSecurity Affairs·Jul 15, 17:07 UTC · Jul 15, 2021Ransomware57
BlackByte Ransomware group targets recently patched VMware ESXi flaw CVE-2024Security Affairs·Aug 28, 14:39 UTC · Aug 28, 2024RansomwareCVE-2024-3708560
Ransomware gangs exploit VMware ESXi bug CVE-2024Security Affairs·Jul 29, 20:55 UTC · Jul 29, 2024RansomwareCVE-2024-37085CVE-2023-2825260
BlackMatter ransomware also targets VMware ESXi serversSecurity Affairs·Aug 6, 06:53 UTC · Aug 6, 2021Ransomware60
CISA confirms exploitation of VMware ESXi flaw by ransomware attackersHelp Net Security·Feb 5, 00:00 UTC · Feb 5, 2026Ransomware in the wildCVE-2025-22225CVE-2025-22224CVE-2025-2222660
Ransomware gang uses a Python script to encrypt VMware ESXi serversSecurity Affairs·Oct 5, 16:13 UTC · Oct 5, 2021Ransomware160
Royal Ransomware adds support for encrypting Linux, VMware ESXi systemsSecurity Affairs·Feb 6, 14:51 UTC · Feb 6, 2023Ransomware57
Experts analyze first LockBit ransomware for Linux and VMware ESXiSecurity Affairs·Jan 27, 09:48 UTC · Jan 27, 2022Ransomware57
VMware ESXi auth bypass zero-day exploited by ransomware operators (CVE-2024-37085)Help Net Security·Jul 30, 00:00 UTC · Jul 30, 2024Ransomware in the wildCVE-2024-3708560
Scattered Spider targets VMware ESXi in using social engineeringSecurity Affairs·Jul 28, 10:40 UTC · Jul 28, 2025Ransomware57
Thousands of unpatched VMware ESXi servers hit by ransomware via old bug (CVE-2021-21974)Help Net Security·Feb 8, 12:11 UTC · Feb 8, 2023RansomwareCVE-2021-2197460
VMware ESXi Flaw Exploited by Ransomware Groups for Admin AccessThe Hacker News·Jul 31, 04:04 UTC · Jul 31, 2024Ransomware in the wildCVE-2024-37085CVE-2023-2825260
Experts detailed a previously undetected VMware ESXi backdoorSecurity Affairs·Dec 13, 14:15 UTC · Dec 13, 2022MalwareCVE-2019-5544CVE-2020-399247
Leaked source code of Babuk ransomware used by 10 different ransomware families targeting VMware ESXiSecurity Affairs·May 12, 20:17 UTC · May 12, 2023Ransomware57
Play Ransomware Expands to Target VMWare ESXi EnvironmentsInfosecurity Magazine·Jul 22, 17:15 UTC · Jul 22, 2024Ransomware60
BlackByte Ransomware Exploits VMware ESXi Flaw in Latest Attack WaveThe Hacker News·Aug 29, 15:41 UTC · Aug 29, 2024RansomwareCVE-2024-3708560
Pwn2Own Berlin 2025 Day Two: researcher earned 150K hacking VMware ESXiSecurity Affairs·May 16, 20:11 UTC · May 16, 2025Exploit / PoC60
Week in review: VMware ESXi servers under attack, ChatGPT’s malicious potential, Reddit breachedHelp Net Security·Feb 12, 00:00 UTC · Feb 12, 2023Data breachCVE-2021-2197460
Week in review: VMware ESXi zero-day exploited, SMS Stealer malware targeting Android usersHelp Net Security·Aug 4, 00:00 UTC · Aug 4, 2024Exploit / PoC in the wildCVE-2023-45249CVE-2024-3708560
VMware patches critical flaws in ESXi, Workstation, Fusion and Cloud FoundationHelp Net Security·Mar 7, 00:00 UTC · Mar 7, 2024VulnerabilityCVE-2024-22252CVE-2024-22253CVE-2024-22254+1 CVEs60
Threat Analysis: VMware ESXi Attacks Soared in 2022Infosecurity Magazine·Feb 15, 12:00 UTC · Feb 15, 2023RansomwareCVE-2021-2197460
Critical RCE Flaws Affect VMware ESXi and vSphere Client — Patch NowThe Hacker News·Feb 24, 17:35 UTC · Feb 24, 2021Vulnerability in the wildCVE-2021-21972CVE-2019-19781CVE-2021-21973+3 CVEs60
New Malware Families Found Targeting VMware ESXi HypervisorsThe Hacker News·Oct 2, 05:17 UTC · Oct 2, 2022Malware55
Scattered Spider Hijacks VMware ESXi to Deploy Ransomware on Critical U.S. InfrastructureThe Hacker News·Jul 29, 04:19 UTC · Jul 29, 2025Ransomware60
China-Linked Hackers Exploit VMware ESXi ZeroThe Hacker News·Jan 12, 16:25 UTC · Jan 12, 2026Ransomware in the wildCVE-2025-22224CVE-2025-22225CVE-2025-2222660