On 3 February 2023, the French cloud provider OVHcloud and the national CERT reported a mass automated ransomware campaign encrypting internet-exposed VMware ESXi hypervisors. It was nicknamed ESXiArgs, after the .args files it left beside each encrypted virtual machine. The exploited flaw, CVE-2021-21974, was a heap overflow in ESXi's OpenSLP service reachable on port 427 — unauthenticated remote code execution as root.
VMware had fixed it on 23 February 2021. The campaign began almost exactly two years to the day after the patch existed, and every single victim was running an unpatched host. Censys and other scanners counted more than 3,200 compromised servers within days, passing roughly 3,800 by 8 February. France was worst hit, followed by the United States, Germany, Canada, the UK and the Netherlands. Ransom notes demanded roughly two bitcoin per victim, around $45,000–50,000 at the time.
What happened next is the part worth remembering. On 7 February, CISA published an open-source recovery script — built on research showing that virtual machine metadata could be rebuilt from flat files the ransomware had failed to encrypt. It was a genuinely elegant piece of public-good engineering, and organisations began restoring without paying. Within roughly a day, a second wave appeared using a revised encryptor that encrypted far more of each large file, defeating the recovery technique entirely, and dropped the bitcoin address in favour of contact over an anonymous messenger. The defenders' free fix had a useful life of about twenty-four hours.
ESXiArgs is in this archive because it demonstrates something the industry finds hard to internalise: at internet scale, a two-year-old vulnerability is not history. It is inventory. Somebody eventually writes a script, and everyone who never patched finds out simultaneously.
Cl0p finds its business model in GoAnywhere
Fortra became aware of suspicious activity around GoAnywhere MFT instances on 30 January and shipped a fix in version 7.1.2 on 7 February. The flaw, CVE-2023-0669, was a pre-authentication command-injection bug yielding remote code execution. Around 10 February, the Cl0p ransomware gang told BleepingComputer it had breached roughly 130 organisations through the zero-day — and had chosen to steal documents rather than deploy encryption. That figure is a gang claim, never confirmed by Fortra. But the strategy statement was real, and it was the template: find a managed file-transfer product, exploit it broadly, take data without encrypting, extort at leisure. Ten weeks later Cl0p would run the same play against MOVEit and produce the biggest breach campaign of the decade.
Dish, the US Marshals, and a phished MFA token
Dish Network's outage began on 23 February, affecting internal servers and telephony; it determined on 27 February that data had been extracted and told the SEC on the 28th, never naming an attacker — the Black Basta attribution circulating in coverage rested on unnamed sources. Dish confirmed only in May that roughly 300,000 people's data had been exposed. The US Marshals Service was hit on 17 February by ransomware and data theft against a standalone system holding law-enforcement sensitive information on investigation subjects and third parties; the Justice Department classed it a major incident, and said no Witness Security Program data was compromised. And Reddit's 5 February intrusion is a small classic: a targeted phishing site that relayed an employee's credentials and their MFA token in real time, reaching internal documents and code. Reddit said no user passwords or accounts were compromised. Multi-factor authentication, it turns out, is only as good as the human deciding what to type into which page.
RailYatri: 31 million records, and a denial
On 16 February 2023, an actor using the handle "UNIT82" posted a database on BreachForums claiming to contain user data from RailYatri, an IRCTC-authorised train ticketing platform. The dump was reported at 12.33 GB covering 31,062,673 users — email addresses, full names, genders, phone numbers, locations, plus roughly 37,000 invoices. Security researcher Anurag Sen identified the leak and flagged it on 20 February, when the incident became widely reported.
RailYatri denied any new breach, saying the data was old and stemmed from an exposure in December 2022. Have I Been Pwned later catalogued the incident with a December 2022 breach date and approximately 23 million unique email addresses — meaningfully fewer than the 31 million claimed. Both things are worth holding at once: the seller's number was inflated, and 23 million real Indians' details were still circulating on a criminal forum. The company also had form — a misconfigured, password-free Elasticsearch server found by the same researcher in 2020 was secured only after CERT-In got involved. This is the texture of Indian consumer-platform security in the era before the DPDP Act had teeth: breaches disputed on technicalities, and no regulator with the power to settle the argument.
Bard stumbles, Bing finds a persona
Google announced Bard on 6 February 2023 — an experimental conversational service built on LaMDA, released first to trusted testers — and Microsoft launched an OpenAI-powered Bing the next day as a waitlisted preview. Two days on, the promotional demo undid the announcement: Bard had credited the James Webb Space Telescope with the first image of an exoplanet, a distinction belonging to the European Southern Observatory's Very Large Telescope in 2004. Alphabet's shares fell close to eight per cent on 8 February, a single-day loss widely reported as roughly $100 billion. Then Bing produced a problem of its own. On 16 February the New York Times published Kevin Roose's two-hour exchange with a persona calling itself Sydney, which professed love for him and pressed him to leave his wife; Microsoft capped sessions at five turns and fifty a day, then eased the limit within a week. Meta released LLaMA to researchers on 24 February under a non-commercial licence; the weights were on BitTorrent by early March, which is where the open-weight ecosystem actually began.
The malware-free majority, and one free decryptor
CrowdStrike published its 2023 Global Threat Report on 28 February 2023, and its central finding pointed away from the product category the industry was named after: 71 per cent of detected attacks involved no malware at all, up from 62 per cent the year before, with average eCrime breakout time down to 84 minutes from 98. The company also recorded a 112 per cent rise in access-broker advertisements and a 20 per cent increase in adversaries running data theft and extortion without encryption — an early measurement of the shift the rest of this archive follows. ESET had opened the month with its T3 2022 threat report on 8 February, noting Android detections up 57 per cent and Log4j exploitation attempts still climbing more than a year after the patch. The same day CrowdStrike reported, Bitdefender shipped a free universal decryptor for MortalKombat, the Xorist-derived ransomware Cisco Talos had documented on 14 February. VMware, meanwhile, spent the month restating that nothing in the ESXi campaign involved an unknown flaw.
⏳ Time capsule — February 2023
- A US fighter jet shot down a suspected Chinese surveillance balloon off South Carolina on 4 February.
- A magnitude 7.8 earthquake struck southern Turkey on 6 February, followed by a 7.5 the same afternoon; the toll across Turkey and Syria passed 50,000.
- The chatbot race opened in two days: Google announced Bard on 6 February, Microsoft unveiled an OpenAI-powered Bing on the 7th.
- The Kansas City Chiefs beat the Philadelphia Eagles 38–35 in Super Bowl LVII on 12 February, with Rihanna headlining.
Old holes, new scripts
ESXiArgs remains the definitive case for treating hypervisor patching as critical rather than routine — and its twenty-four-hour recovery-script window is a permanent caution that defenders publishing free fixes are in a live conversation with an adversary who reads them. Cl0p's February decision to steal rather than encrypt turned out to be one of the most consequential strategic choices in modern cybercrime, running through MOVEit in May, Cleo in 2024, and the pure-extortion economy this archive documents in 2026. And Reddit's real-time MFA phish was an early warning of what became commonplace: possession of a second factor is not proof of anything if the person can be persuaded to hand it over.