Stay informed about the latest tactics used in ESXi ransomware attacks. Learn how attackers exploit virtualized infrastructure components to disrupt operations.

Discover the sophisticated operations of Lynx Ransomware-as-a-Service (RaaS) and its impact on businesses worldwide. Dive into the report by Group-IB.

Learn about QBACKCONNECT and its role in the tactics of Black Basta and Cactus ransomware groups for cyber threats.

ESXi Testing Toolkit is a command-line utility designed to help security teams test detections deployed in ESXi environments.

Broadcom addresses four new vulnerabilities in VMware ESXi, vCenter, Workstation, and Fusion, ranging from command execution to XSS. Update now.

Trend Micro uncovers BERT ransomware (Water Pombero) deploying multi-threaded variants against Windows, Linux, and ESXi systems, showing code similarities to REvil's Linux variant.

Broadcom has released urgent patches for four critical (CVSS up to 9.3) VMware vulnerabilities affecting ESXi, Workstation, and Fusion, allowing host code execution.

Sygnia uncovers "Fire Ant," a sophisticated cyber-espionage campaign exploiting VMware ESXi and vCenter since early 2025, using advanced techniques to evade detection and maintain persistent access.

How Scattered Spiders’ Fake IT Calls Are Bypassing Security to Cripple VMware ESXi

Welcome to my first article on my journey into Cybersecurity! This year marks the beginning of a big transition for me — from a background…

LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than ever.

LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than its predecessors.

After Operation Cronos, LockBit resurfaced with the cross-platform 5.0 ("ChuongDong") ransomware, which uses advanced anti-analysis and hits Windows, Linux, and ESXi servers.

Cisco Talos reports Kraken, a HelloKitty successor, is a cross-platform RaaS targeting Windows/ESXi. The malware uniquely benchmarks CPU/IO to optimize encryption speed and uses Cloudflared/SSHFS for persistence.

The Kraken ransomware (linked to HelloKitty) targets Windows, Linux, and ESXi using double extortion. It benchmarks system performance before encrypting to maximize damage.

Despite takedown, LockBit 5.0 resurges as a cross-platform threat. The new variant blinds Windows Event Tracing (ETW), uses Invisible Mode for stealth encryption, and overwrites free disk space.