BlackSuit Ransomware Targets VMware ESXi Servers: A New Threat to Virtualized Environments

BlackSuit ransomware has emerged as a significant threat targeting VMware ESXi servers, which are widely used in enterprise virtualized environments. This ransomware variant specifically exploits vulnerabilities in VMware ESXi to encrypt virtual machines, causing severe operational disruptions and financial losses for affected organizations. The attack vector often involves exploiting unpatched vulnerabilities or weak security configurations, allowing threat actors to gain unauthorized access and deploy the ransomware payload. BlackSuit's focus on VMware ESXi highlights the increasing trend of ransomware groups targeting critical infrastructure and virtualization platforms to maximize impact. Organizations using VMware ESXi are urged to implement robust security measures, including timely patching of known vulnerabilities, enforcing strong access controls, and continuous monitoring for suspicious activities. Backup strategies should be regularly tested to ensure rapid recovery in case of an attack. Cybersecurity teams must stay informed about the latest threat intelligence related to BlackSuit ransomware and similar threats to adapt their defenses accordingly. This development underscores the importance of securing virtual environments as they become integral to modern IT infrastructure. The rise of ransomware targeting such platforms calls for enhanced vigilance, comprehensive security policies, and collaboration between cybersecurity professionals and VMware to mitigate risks effectively. By understanding the tactics, techniques, and procedures (TTPs) employed by BlackSuit operators, organizations can better prepare to defend against these sophisticated attacks and protect their critical assets.

This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 15 Oct 2025 13:30:14 +0000


Cyber News related to BlackSuit Ransomware Targets VMware ESXi Servers: A New Threat to Virtualized Environments

BlackSuit ransomware - what you need to know - What's going on? A cybercriminal group calling itself BlackSuit has claimed responsibility for a series of ransomware attacks, including breaches at schools in central Georgia. And earlier in the year, a zoo in Tampa Bay was targeted by the same ...
1 year ago Tripwire.com Blacksuit
10 Best Ransomware Protection Tools - 2025 - It protects devices from ransomware and other cyber threats using advanced threat intelligence, behavioral analysis, and cloud-based technology. It monitors and prevents ransomware assaults on personal files and automatically restores encrypted ...
8 months ago Cybersecuritynews.com
Investigation of Possible Causes of ESXiArgs Ransomware Attacks Suggests VMware is Not at Fault - Edward Hawkins, the High-Profile Product Incident Response Manager at VMware, has denied allegations that two-year-old security flaws have been used in the current ESXiArgs ransomware attacks. Over the weekend, reports surfaced about cybercriminals ...
2 years ago Hackread.com CVE-2021-21974
BlackSuit Ransomware Targets VMware ESXi Servers: A New Threat to Virtualized Environments - BlackSuit ransomware has emerged as a significant threat targeting VMware ESXi servers, which are widely used in enterprise virtualized environments. This ransomware variant specifically exploits vulnerabilities in VMware ESXi to encrypt virtual ...
4 weeks ago Cybersecuritynews.com CVE-2021-21985 BlackSuit
10 Best Ransomware File Decryptor Tools in 2025 - Kaspersky Rakhni Decryptor contains different decryption tools based on various versions of Rakhni ransomware and helps you decrypt encrypted files on your system. PyLocky Ransomware Decryption Tool is a free and open source developed and released by ...
7 months ago Cybersecuritynews.com
Linux version of Qilin ransomware focuses on VMware ESXi - A sample of the Qilin ransomware gang's VMware ESXi encryptor has been found and it could be one of the most advanced and customizable Linux encryptors seen to date. Due to this adoption, almost all ransomware gangs have created dedicated VMware ESXi ...
1 year ago Bleepingcomputer.com Qilin
25 Best Managed Security Service Providers (MSSP) - 2025 - Pros & Cons: ProsConsStrong threat intelligence & expert SOCs.High pricing for SMBs.24/7 monitoring & rapid incident response.Complex UI and steep learning curve.Flexible, scalable, hybrid deployments.Limited visibility into endpoint ...
4 months ago Cybersecuritynews.com
BlackSuit ransomware leak sites seized in Operation Checkmate - Earlier today, the websites on the BlackSuit .onion domains were replaced with seizure banners announcing that the ransomware gang's sites were taken down by the U.S. Homeland Security Investigations federal law enforcement agency as part ...
3 months ago Bleepingcomputer.com Blacksuit
VMware ESXi 8.0 Update 3e Released for Free, What's New! - This marks a significant policy reversal after Broadcom discontinued the free ESXi offering following its acquisition of VMware, a move that had pushed many users toward alternative virtualization platforms. Broadcom has officially reintroduced the ...
6 months ago Cybersecuritynews.com
Royal ransomware may soon rebrand, BlackSuit links confirmed The Register - The FBI and the US govt's Cybersecurity and Infrastructure Security Agency have released fresh guidance on the Royal ransomware operation, saying that evidence suggests it may soon undergo a long-speculated rebrand. The agencies didn't specify a ...
1 year ago Theregister.com Blacksuit
FBI: Royal ransomware asked 350 victims to pay $275 million - The FBI and CISA revealed in a joint advisory that the Royal ransomware gang has breached the networks of at least 350 organizations worldwide since September 2022. In an update to the original advisory published in March with additional information ...
1 year ago Bleepingcomputer.com Blacksuit
Latest Information Security and Hacking Incidents - The ransomware strain Qilin has surfaced as a new danger to computers using VMware ESXi, which is a recent development in the cryptocurrency space. Concerned observers have expressed concern over the fact that this Qilin Linux version exhibits a ...
1 year ago Cysecurity.news Qilin
BlackSuit ransomware gang claims attack on KADOKAWA corporation - The BlackSuit ransomware gang claimed a recent cyberattack on KADOKAWA corporation and is now threatening to publish stolen data if a ransom is not paid. KADOKAWA is a Japanese media conglomerate that operates numerous companies in film, publishing, ...
1 year ago Bleepingcomputer.com Blacksuit
BlackSuit ransomware gang claims attack on KADOKAWA corporation - The BlackSuit ransomware gang claimed a recent cyberattack on KADOKAWA corporation and is now threatening to publish stolen data if a ransom is not paid. KADOKAWA is a Japanese media conglomerate that operates numerous companies in film, publishing, ...
1 year ago Bleepingcomputer.com Blacksuit
BERT Ransomware Forcibly Shut Down ESXi Virtual Machines to Disrupt Recovery - A newly emerged ransomware group known as BERT has introduced a particularly disruptive capability that sets it apart from traditional ransomware operations: the ability to forcibly terminate ESXi virtual machines before encryption, significantly ...
4 months ago Cybersecuritynews.com
A type of malicious software called Royal Ransomware designed for Linux systems is attacking VMware ESXi servers - The latest ransomware operation to target Linux devices is Royal Ransomware. It is specifically designed to encrypt VMware ESXi virtual machines. Other ransomware gangs, such as Black Basta, LockBit, BlackMatter, AvosLocker, REvil, HelloKitty, ...
2 years ago Bleepingcomputer.com LockBit RansomEXX Black Basta
No Signs of Unpatched Vulnerabilities Discovered in ESXiArgs Ransomware Attacks - VMware reported on Monday that there is no proof that hackers are using an unknown security flaw, also known as a zero-day, in its software as part of a ransomware attack. Most reports suggest that outdated products with known vulnerabilities that ...
2 years ago Thehackernews.com CVE-2021-21974
CDK Global says all dealers will be back online by Thursday - CDK Global says that its dealer management system, impacted by a massive IT outage following a June 18th ransomware attack, will be back online by Thursday for all car dealerships. The company is also working on restoring access to other affected ...
1 year ago Bleepingcomputer.com Blacksuit
Scattered Spider is running a VMware ESXi hacking spree - This allows Scattered Spider to scan the network devices for IT documentation that would provide high-value targets, like the names of domain or VMware vSphere administrators, and security groups that can provide administrative permissions over the ...
3 months ago Bleepingcomputer.com Scattered Spider
BlackSuit Ransomware’s Data Leak and Negotiation Portal Seized - Some of the groups listed are the U.S. Department of Homeland Security, the FBI, Europe’s Europol, the UK’s National Crime Agency (NCA), and police organizations from countries like Germany, Ukraine, Lithuania, and Canada. A major win against ...
3 months ago Cybersecuritynews.com Blacksuit
RansomHouse gang automates VMware ESXi attacks with new MrAgent tool - The RansomHouse ransomware operation has created a new tool named 'MrAgent' that automates the deployment of its data encrypter across multiple VMware ESXi hypervisors. RansomHouse is a ransomware-as-a-service operation that emerged in December 2021 ...
1 year ago Bleepingcomputer.com LockBit
41,500+ VMware ESXi Instances Vulnerable to Code Execution Attacks - We are scanning & reporting out VMware ESXi CVE-2025-22224 vulnerable instances ("a malicious actor with local admin privileges on a virtual machine may exploit this to execute code as virtual machine's VMX process running on ...
8 months ago Cybersecuritynews.com CVE-2025-22224
The Week in Ransomware - Today's column brings you two weeks of information on the latest ransomware attacks and research after we skipped last week's article. BleepingComputer has learned that some of the BlackCat/ALPHV affiliates are not buying the explanation and have ...
1 year ago Bleepingcomputer.com LockBit Qilin Noescape
FBI seizes $2.4M in Bitcoin from new Chaos ransomware operation - "The seized funds were traced to a cryptocurrency address allegedly associated with a member of the Chaos ransomware group, known as 'Hors,' who has been tied to ransomware attacks against victims here in the Northern District of Texas and ...
3 months ago Bleepingcomputer.com Blacksuit
VMware fixes critical code execution flaw in vCenter Server - VMware issued security updates to fix a critical vCenter Server vulnerability that can be exploited to gain remote code execution attacks on vulnerable servers. vCenter Server is the central management hub for VMware's vSphere suite, and it helps ...
1 year ago Bleepingcomputer.com CVE-2023-34048 CVE-2023-34056

Cyber Trends (last 7 days)