Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes
Our summary
Kaspersky's Global Emergency Response Team detailed an incident in which the BlackNevas ransomware gang wiped out an entire virtualization estate — four ESXi hosts, all their guest VMs, two vCenter Server Appliances, and connected backup systems — over a ten-day intrusion. Notably, the attackers never exploited a hypervisor vulnerability; instead they reused stolen credentials, abused vCenter's Host Profiles feature to enable SSH on ESXi hosts, and installed persistence via MeshAgent and a Ligolo-ng tunnel disguised as a legitimate systemd service. Before detonating the ESXi-targeting payload (which overwrote the first 2KB of virtual disk files via a Trigona/BlackNevas-style wiper), the operators deliberately disabled and destroyed backup infrastructure to block recovery. Kaspersky notes this fits a broader trend since the 2021 Babuk ESXi source-code leak, which lowered the barrier for at least ten ransomware families to build ESXi-capable lockers, and separately flags known-exploited VMware flaws like CVE-2024-37085, CVE-2021-22005, CVE-2021-21972, CVE-2021-21985, CVE-2023-34048, CVE-2024-38812, CVE-2024-38813, and the CVE-2025-22224/22225/22226 chain as common entry routes into virtualization management planes.
Below is the opening; the full story is at Kaspersky Securelist.
From Kaspersky Securelist
Our Global Emergency Response Team (GERT) recently investigated an engagement in which an adversary destroyed an organization’s virtualization estate over a 10-day period. The campaign targeted four ESXi hosts, every virtual machine hosted on them, both vCenter Server Appliances, and all connected backup infrastructure. The ransom notes identified the attacker as the BlackNevas group, first observed in November 2024. What’s interesting about this attack is that no virtualization layer vulnerabilities were exploited: no guest-to-host escapes, no hypervisor memory corruption. Every action taken against ESXi was executed through legitimate VMware management interfaces.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.