ESXi

Ransomware Attack on SoftBank's IDCF Cloud Encrypts 3.6PB in 7 Minutes as Operations Team Misses Alerts for 7 Hours

SoftBank subsidiary IDC Frontier suffered a ransomware attack on its IDCF Cloud East Japan Region 1 that encrypted 3.6PB of primary storage across 239 hypervisors and 225 datastores in just seven minutes. Attackers also destroyed 554,153 snapshots, eliminating 41.5PB of backup capacity and leaving 495 enterprise and government customers without recoverable data from the provider. Operations staff spent the next seven hours repeatedly rebooting already-encrypted virtual machines and resetting console passwords while failing to locate any of the 225 RECOVER-INFO.txt ransom notes left in datastore root directories. The intrusion was only confirmed after the threat actors directly defaced the vCenter management console with the message “IDCF CLOUD INFRASTRUCTURE SEIZED”. The incident highlights critical gaps in asset inventory, log monitoring, and incident response procedures rather than any zero-day exploit. No ransom was paid; the provider instead focused on public updates while advising customers to rely on their own off-site backups.

R-Vision VM 6.6 Adds Container Scanning, Web Application Audits and Mobile Scanner for Isolated Networks

R-Vision has released version 6.6 of its vulnerability management platform, expanding detection capabilities to web applications, Docker and Kubernetes container environments, and previously unreachable isolated network segments. The new web audit feature inventories resources and identifies associated vulnerabilities, although the company describes the current functionality as basic and not intended to replace dedicated DAST solutions. Container auditing now covers both Docker and Kubernetes, including runtime analysis, with findings presented directly in the host card within the central console. The most notable addition is a mobile scanner that runs on a laptop without requiring dedicated servers, allowing security specialists to audit air-gapped or remote sites and later upload results to the main R-Vision VM instance. The mobile component supports White Box, Black Box, Compliance and web-audit modes, performs full inventory, and is designed to scan up to 2000 hosts. Additional improvements include expanded inventory for ESXi, vCenter and network equipment, updated compliance checks, enhanced dashboards, automation policies and data export options, plus the ability to update agents directly from the interface.