SEXi

MISP
Type:
Unknown
Country:
Unknown
First seen:
Unknown
Details:

SEXi is a ransomware group that targets VMware ESXi servers, encrypting data and demanding ransom payments. They have been observed encrypting virtual machines and backups, causing significant disruptions to services. The group's name is a play on the word "ESXi," indicating a deliberate focus on these systems. SEXi has been linked to other ransomware variants based on the Babuk source code.

References (3)
Metadata
ID: 684
Created: 13/01/2026 17:48
Updated: 08/03/2026 04:00