BlackNevas wiped an ESXi estate via VMware management tools
Over 10 days the attacker hit four ESXi hosts, every guest, both vCenters and connected backups, with no hypervisor exploit.
68
Threat actor
BlackNevas
- Mentions · 7d1
- Mentions · 30d2
- All mentions2
- First seenNov 6, 2026
- Last mentioned1d ago
Timeline
2 articles · newest firstESXi and Proxmox ransomware cases from misconfigured credentials
Attackers compromised hypervisors via monitoring tools and reused root passwords without VM escapes.
70
Appears with
- Kasperskyorganization · 2
- ESXiproduct · 2
- VMwarevendor · 2
- Broadcomvendor · 1
- The Gentlementhreat actor · 1
- vCenter Server Applianceproduct · 1
- Babukmalware · 1
- Proxmoxvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.