Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes

A ransomware attack attributed to the BlackNevas group targeted an organization's virtualization environment over a 10-day period, compromising four ESXi hosts, vCenter Server Appliances, and backup infrastructure. The attackers gained access via SSH using stolen credentials, established persistence on the vCenter appliance using MeshAgent and Ligolo-ng tunneled through a systemd service, and leveraged legitimate VMware management features—such as Host Profiles—to enable SSH on ESXi hosts and deploy ransomware. The attack involved destruction of virtual machines, encryption of datastores, and prior disruption of backup systems to hinder recovery. No ESXi vulnerabilities were exploited; instead, the attackers abused legitimate administrative interfaces and living-off-the-land techniques.

AI-extracted · verify before operational use