ESXiArgs Ransomware Exploiting CVE-2021-21974 (RCE in OpenSLP) and Hunting for IIS Module Backdoors

In this week's Threat SnapShot, we'll first dig into the recent ESXiArgs ransomware affecting thousands of unpatched, internet-facing systems. We'll cover everything you need to know, including the exploit used to gain remote code execution on the ESX server (CVE-2021-21974) and the ransomware modules. We'll also discuss mitigation guidance and a recovery script released by CISA for those affected by the ransomware.

ESXiArgs References:

IIS Module References:
Persistence via IIS Extension Backdoor