I got a security threat message in (VM ESXi) Management Interface

Question

I Have a server in (Leaseweb Germany Datacenter), VMware ESxi 6.7.0 Update 3 installed on it

the 'root' user have a very strong password similar to this level of complexity cK62AzW@$FMu

Today the server went down and when I tried to access the VMware ESXi management interface via the IP address I got the following threat message rather than (VMware ESXi management interface)

I rebooted the server, then the (threat message) was gone and when I accessed to the server I got all VMs mapped to incorrect (*.vmdk) files!!! I changed the server password and fixed the issue by reattaching the correct (vmdk) files to the VMs

How someone can make the IP address replay with this message? I don't have any web server installed just VMware ESXi installed via Leaseweb Customer Portal

How do they change the VMs Hard Disks file's path?

And How to avoid such things like that to happen again. ?

thanks

Answer 1

Details about this issue: https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-VMware-esxi-servers-worldwide/

VMware workaround: https://kb.vmware.com/s/article/76372