Virtualization security: attack layers and misconfiguration impact

Kaspersky's GERT team detailed two ransomware intrusions into ESXi and Proxmox virtual infrastructures that succeeded without exploiting any hypervisor vulnerability or VM escape. In the first case, BlackNevas operators abused a PRTG Network Monitor deployment that held a reusable root password for multiple ESXi hosts, letting them SSH in, disable the execInstalledOnly protection via esxcli, and run an encryption binary while wiping logs. In the second case, the Gentlemen ransomware group found plaintext Proxmox root credentials saved in notes on a compromised admin workstation, then used the root account's VNC websocket access to spread encryption across the entire cluster. Kaspersky stresses that excessive privileges on monitoring tools, shared/reused passwords, direct root SSH access bypassing vCenter controls, and insecure credential storage turned routine administrative access into full-environment compromise, and recommends dedicated monitoring identities, credential vaulting, Lockdown Mode, and network segmentation as remediation.