On 3 February 2023, the French cloud provider OVHcloud and the national CERT reported a mass automated ransomware campaign encrypting internet-exposed VMware ESXi hypervisors. It was nicknamed ESXiArgs, after the .args files it left beside each encrypted virtual machine. The exploited flaw, CVE-2021-21974, was a heap overflow in ESXi's OpenSLP service reachable on port 427 — unauthenticated remote code execution as root.
VMware had fixed it on 23 February 2021. The campaign began almost exactly two years to the day after the patch existed, and every single victim was running an unpatched host. Censys and other scanners counted more than 3,200 compromised servers within days, passing roughly 3,800 by 8 February. France was worst hit, followed by the United States, Germany, Canada, the UK and the Netherlands. Ransom notes demanded roughly two bitcoin per victim, around $45,000–50,000 at the time.
What happened next is the part worth remembering. On 7 February, CISA published an open-source recovery script — built on research showing that virtual machine metadata could be rebuilt from flat files the ransomware had failed to encrypt. It was a genuinely elegant piece of public-good engineering, and organisations began restoring without paying. Within roughly a day, a second wave appeared using a revised encryptor that encrypted far more of each large file, defeating the recovery technique entirely, and dropped the bitcoin address in favour of contact over an anonymous messenger. The defenders' free fix had a useful life of about twenty-four hours.
ESXiArgs is in this archive because it demonstrates something the industry finds hard to internalise: at internet scale, a two-year-old vulnerability is not history. It is inventory. Somebody eventually writes a script, and everyone who never patched finds out simultaneously.
Cl0p finds its business model in GoAnywhere
Fortra became aware of suspicious activity around GoAnywhere MFT instances on 30 January and shipped a fix in version 7.1.2 on 7 February. The flaw, CVE-2023-0669, was a pre-authentication command-injection bug yielding remote code execution. Around 10 February, the Cl0p ransomware gang told BleepingComputer it had breached roughly 130 organisations through the zero-day — and had chosen to steal documents rather than deploy encryption. That figure is a gang claim, never confirmed by Fortra. But the strategy statement was real, and it was the template: find a managed file-transfer product, exploit it broadly, take data without encrypting, extort at leisure. Ten weeks later Cl0p would run the same play against MOVEit and produce the biggest breach campaign of the decade.
Dish, the US Marshals, and a phished MFA token
Dish Network's outage began on 23 February, affecting internal servers and telephony; it determined on 27 February that data had been extracted and told the SEC on the 28th, never naming an attacker — the Black Basta attribution circulating in coverage rested on unnamed sources. Dish confirmed only in May that roughly 300,000 people's data had been exposed. The US Marshals Service was hit on 17 February by ransomware and data theft against a standalone system holding law-enforcement sensitive information on investigation subjects and third parties; the Justice Department classed it a major incident, and said no Witness Security Program data was compromised. And Reddit's 5 February intrusion is a small classic: a targeted phishing site that relayed an employee's credentials and their MFA token in real time, reaching internal documents and code. Reddit said no user passwords or accounts were compromised. Multi-factor authentication, it turns out, is only as good as the human deciding what to type into which page.
RailYatri: 31 million records, and a denial
On 16 February 2023, an actor using the handle "UNIT82" posted a database on BreachForums claiming to contain user data from RailYatri, an IRCTC-authorised train ticketing platform. The dump was reported at 12.33 GB covering 31,062,673 users — email addresses, full names, genders, phone numbers, locations, plus roughly 37,000 invoices. Security researcher Anurag Sen identified the leak and flagged it on 20 February, when the incident became widely reported.
RailYatri denied any new breach, saying the data was old and stemmed from an exposure in December 2022. Have I Been Pwned later catalogued the incident with a December 2022 breach date and approximately 23 million unique email addresses — meaningfully fewer than the 31 million claimed. Both things are worth holding at once: the seller's number was inflated, and 23 million real Indians' details were still circulating on a criminal forum. The company also had form — a misconfigured, password-free Elasticsearch server found by the same researcher in 2020 was secured only after CERT-In got involved. This is the texture of Indian consumer-platform security in the era before the DPDP Act had teeth: breaches disputed on technicalities, and no regulator with the power to settle the argument.
⏳ Time capsule — February 2023
- A US fighter jet shot down a suspected Chinese surveillance balloon off South Carolina on 4 February.
- A magnitude 7.8 earthquake struck southern Turkey on 6 February, followed by a 7.5 the same afternoon; the toll across Turkey and Syria passed 50,000.
- The chatbot race opened in two days: Google announced Bard on 6 February, Microsoft unveiled an OpenAI-powered Bing on the 7th.
- The Kansas City Chiefs beat the Philadelphia Eagles 38–35 in Super Bowl LVII on 12 February, with Rihanna headlining.
Old holes, new scripts
ESXiArgs remains the definitive case for treating hypervisor patching as critical rather than routine — and its twenty-four-hour recovery-script window is a permanent caution that defenders publishing free fixes are in a live conversation with an adversary who reads them. Cl0p's February decision to steal rather than encrypt turned out to be one of the most consequential strategic choices in modern cybercrime, running through MOVEit in May, Cleo in 2024, and the pure-extortion economy this archive documents in 2026. And Reddit's real-time MFA phish was an early warning of what became commonplace: possession of a second factor is not proof of anything if the person can be persuaded to hand it over.