Broadcom has made sweeping changes to VMware’s business since acquiring the company in November 2023, killing off the perpetually licensed versions of VMware’s software and instituting large-scale layoffs. Broadcom executives have acknowledged the “unease” that all of these changes have created among VMware’s customers and partners but so far haven’t been interested in backtracking.

Among the casualties of the acquisition is the free version of VMware’s vSphere Hypervisor, also known as ESXi. ESXi is “bare-metal hypervisor” software, meaning that it allows users to run multiple operating systems on a single piece of hardware while still allowing those operating systems direct access to disks, GPUs, and other system resources.

One alternative to ESXi for home users and small organizations is Proxmox Virtual Environment, a Debian-based Linux operating system that provides broadly similar functionality and has the benefit of still being an actively developed product. To help jilted ESXi users, the Proxmox team has just added a new “integrated import wizard” to Proxmox that supports importing of ESXi VMs, easing the pain of migrating between platforms.

The announcement claims that an imported ESXi VM will have “most of its config mapped to Proxmox VE’s config model” to minimize downtime. The documentation indicates that the import wizard is still “in tech preview state” and “under active development,” though it’s also said to be “working stable.” The importer works with VMs made in ESXi versions 6.5 through 8.0, which was the most recent version available before Broadcom discontinued the software.

A wiki article from Proxmox also provides more information about preparing your VMs for the move. The article recommends uninstalling guest tools made to work with ESXi, noting network configuration settings like MAC addresses or any manually assigned IP addresses, and disabling any full-disk encryption that stores its keys in your hypervisor’s virtual TPM. It’s currently not possible to migrate vTPM settings from one hypervisor to another, so booting up a VM with disk encryption enabled will require a recovery key before the machine will boot.

Like the free version of ESXi, the free version of Proxmox VE doesn’t include technical support beyond what is offered in Proxmox’s community forums. For people who use Proxmox VE and want to deploy it more widely in a business, Proxmox does offer a few subscription tiers that provide access to its more stable Enterprise Repositories and actual technical support from the software’s developers.

The Agenda ransomware group has been ramping up infections worldwide, thanks to a new and improved variant of its virtual machine-focused ransomware.

Agenda (aka Qilin and Water Galura) was first spotted in 2022. Its first, Golang-based ransomware was used against an indiscriminate range of targets: in healthcare, manufacturing, and education, from Canada to Colombia and Indonesia.

Toward the end of 2022, Agenda’s proprietors rewrote its malware in Rust, a useful language for malware authors looking to spread their work across operating systems. With the Rust variant, Agenda was able to compromise organizations across finance, law, construction, and more, predominantly in the US but also in Argentina, Australia, Thailand, and elsewhere.

Just recently, Trend Micro identified a new Agenda ransomware variant in the wild. This latest Rust-based version comes with a variety of new functionalities and stealth mechanisms, and sets its sights squarely on VMware vCenter and ESXi servers.

“Ransomware attacks against ESXi servers are a growing trend,” notes Stephen Hilt, senior threat researcher at Trend Micro. “They’re attractive targets for ransomware attacks because they often host critical systems and applications, and the impact of a successful attack can be significant.”

VMware is urging customers to patch critical vulnerabilities that make it possible for hackers to break out of sandbox and hypervisor protections in all versions, including out-of-support ones, of VMware ESXi, Workstation, Fusion, and Cloud Foundation products.

A constellation of four vulnerabilities—two carrying severity ratings of 9.3 out of a possible 10—are serious because they undermine the fundamental purpose of the VMware products, which is to run sensitive operations inside a virtual machine that’s segmented from the host machine. VMware officials said that the prospect of a hypervisor escape warranted an immediate response under the company’s IT Infrastructure Library, a process usually abbreviated as ITIL.

In the latest development following Broadcom’s November 2023 acquisition of VMware, the company has decided to kill off the free version of VMware’s ESXi hypervisor.

A knowledge base article posted by the company outlined the move, which comes alongside the termination of perpetual licensing, marking the Free ESXi Hypervisor as End Of General Availability (EOGA).

The announcement reads: “VMware vSphere Hypervisor (free edition) is no longer available on the VMware website,” confirming that ESXi 7.x and 8.x are affected.