securelist Nov 6, 2026 · Crawled Nov 7, 2026

Virtualization security: attack layers and misconfiguration impact

2 IoCs 5 CVEs

AI Summary

Kaspersky GERT investigated two ransomware incidents involving ESXi and Proxmox virtualization environments. In the first case, attackers exploited a monitoring system (PRTG) that stored reusable root credentials, enabling SSH access to multiple ESXi hosts. They disabled the execInstalledOnly security policy and deployed the BlackNevas ransomware binary 'esx' to encrypt systems. In the second case, attackers obtained plaintext credentials from a compromised administrator workstation, allowing them to access Proxmox via the root account and activate VNC websockets to execute ransomware across the cluster. Both attacks leveraged misconfigurations such as credential reuse, unsafe storage, and excessive privileges rather than software vulnerabilities.

AI-extracted · verify before operational use

Extracted Entities 5 found

CVE CVE-2026-31431 → CVE CVE-2024-21626 → CVE CVE-2026-41567 → CVE CVE-2026-41568 → CVE CVE-2026-42306 →

Indicators of Compromise 2 extracted

Type	Value	Detail
Filename	esx	Details →
Domain	api2/json/nodes/******/vncwebsocket	Details →

MITRE ATT&CK TTPs 16 techniques

T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.006 Timestomp · Defense Evasion T1071.004 DNS · Command And Control T1078.004 Cloud Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1098 Account Manipulation · Persistence T1133 External Remote Services · Persistence T1134 Access Token Manipulation · Defense Evasion T1210 Exploitation of Remote Services · Lateral Movement T1220 XSL Script Processing · Defense Evasion T1484.001 Group Policy Modification · Defense Evasion T1566 Phishing · Initial Access T1583 Acquire Infrastructure · Resource Development