
With a unified defense across VMware, Windows, Linux and Mac environments, Arms Cyber’s platform addresses a critical gap in a market that has seen the number of hypervisor-centric ransomware attacks more than double in the past three years.
Fulton, Maryland (December 18, 2025) Arms Cyber, a leader in ransomware prevention and response, announces the expansion of its anti-ransomware platform to include comprehensive hypervisor protection. With the addition of support for VMware ESXi hypervisors, Windows, Linux and macOS environments, Arms Cyber becomes the first software vendor to offer a unified ransomware defense from a single platform.
The launch of Arms Cyber’s cross-hypervisor capabilities comes as ransomware operators increasingly target virtualization infrastructure to maximize impact. According to Microsoft, incidents targeting ESXi hypervisors have more than doubled over the past three years, with threat actors recognizing that a single compromised hypervisor can encrypt dozens of virtual machines simultaneously, paralyzing entire enterprises with devastating efficiency. For example, in April, the DragonForce ransomware attack targeting major UK retailers encrypted VMware ESXi hypervisors at Marks & Spencer, halting online sales for over 46 days and resulting in hundreds of millions of dollars in profit losses and market value.
“Ransomware groups have fundamentally shifted tactics,” said Josh McCarthy, the Chief Product Officer at Arms Cyber. “Attackers are bypassing traditional endpoints to strike directly at the virtualization layer where they can achieve maximum damage with minimal effort. Most security systems were never designed to protect hypervisors. We added this capability because organizations deserve protection that matches where attackers are actually striking.”
Ransomware Meets Its Match with Cross-Hypervisor Support
Arms Cyber takes a unique approach to solving this problem. Upon initial access, attackers using LOTL techniques establish patterns that deviate from normal operating procedures. Arms Cyber’s zero trust policies build off these deviation requirements to reinforce more effective prevention. Intruders also rely on reliable information about their target, and static environments offer an ideal landscape for gathering such data. Integrating Arms Cyber’s anti-ransomware platform at various layers introduces a level of diversity and dynamism, making it nearly impossible for attackers to gain the actionable intelligence they need about their target.
With the addition of support for VMware, Windows, Linux and macOS environments, Arms Cyber is securing the virtualization layer where attacks often hide. The new release hardens remote access with multi-factor authentication, blocks malicious executables with application filtering and process controls, and enforces network and file access lockdowns across the hypervisor environment. Decoy files provide early detection, while AI-powered response halts attacks with over 98% efficacy, automates file rollback, and removes attacker persistence. The platform deploys easily on VMware ESXi, Nutanix, XenServer, Citrix Hypervisor, Proxmox, RHEV, and KVM, requires no kernel modifications, and runs with a minimal footprint and performance impact.
About Arms Cyber
Arms Cyber delivers a revolutionary approach to defeat attacks others miss through a three-part strategy: Conceal, Deceive, and Restore — powered by stealth. By adding stealth to an organization’s existing security posture, we keep critical data invisible to attackers, detect threats before they cause serious damage, and enable rapid recovery without compromise. The outcome: no ransom payouts, no public breaches, no costly downtime.
Contact:
Kevin Wolf
TGPR
[email protected]

