Kaspersky's emergency response team has described two ransomware cases in which attackers encrypted entire virtualised environments without exploiting a software flaw at all. In both cases, weak access controls, poor network separation and badly managed administrator credentials gave the attackers the keys to the hypervisor layer.

BlackNevas on ESXi

In the first case, attackers linked to the BlackNevas ransomware group reached a Windows system in a virtualised domain-controller segment, where tools including the AnyDesk remote-access program were run. The environment used PRTG Network Monitor to watch its virtual infrastructure, and the monitoring deployment had broad access to the ESXi hosts, with the same root password reused across several nodes. The attackers used that access to log in over SSH, disabled a system restriction with the esxcli command, ran the encryption binary and deleted logs.

The Gentlemen on Proxmox

In the second case, the Gentlemen ransomware group compromised an administrator's workstation and found privileged credentials and access details stored in plain-text notes. The attackers logged in as root, activated the Proxmox VNC web socket, and used it to download and run ransomware across the cluster, encrypting the whole virtual environment.

The lesson

Kaspersky said the cases show that virtualisation security depends as much on credential hygiene and network design as on patching. Administrators should use unique, vaulted credentials for hypervisors, separate monitoring systems from production hosts, and keep administrative workstations free of stored passwords.