CVE-2024-21626

Kaspersky GERT investigated two ransomware incidents involving ESXi and Proxmox virtualization environments. In the first case, attackers exploited a monitoring system (PRTG) that stored reusable root credentials, enabling SSH access to multiple ESXi hosts. They disabled the execInstalledOnly security policy and deployed the BlackNevas ransomware binary 'esx' to encrypt systems. In the second case, attackers obtained plaintext credentials from a compromised administrator workstation, allowing them to access Proxmox via the root account and activate VNC websockets to execute ransomware across the cluster. Both attacks leveraged misconfigurations such as credential reuse, unsafe storage, and excessive privileges rather than software vulnerabilities.