Tool
esxcli
- First Reported
- Apr 23, 2026
- Latest Reported
- Nov 6, 2026
Reported Context (2)
- The threat actor gained root access to the ESXi environment and used the esxcli command to bypass the system restriction by disabling the execInstalledOnly policy to execute the encryption binary and also perform Misconfigurations Enabled Ransomware Attacks on ESXi and Proxmox
- The ESXi ELF (C++) uses ChaCha8 with RSA-4096, performs partial in-place encryption of datastores, and can terminate VMs via esxcli. Rapid7 Analyzes Kyber Ransomware’s Windows and ESXi Variants
CVE (6)
Malware (2)
Threat Actors (2)
MITRE ATT&CK (14)
Vendors (2)
Products (9)
Tools (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.