ESXi and Proxmox ransomware cases from misconfigured credentials
Original title: Virtualization security: attack layers and misconfiguration impact
Attackers compromised hypervisors via monitoring tools and reused root passwords without VM escapes.
Kaspersky investigated ransomware incidents on ESXi and Proxmox. BlackNevas ransomware used PRTG Network Monitor credentials to reach ESXi hosts over SSH. The Gentlemen group exploited plain text admin notes on a workstation to access Proxmox. Shared credentials and weak access controls formed the attack path.
- PRTG stored VMware root credentials
- Same root password reused across ESXi nodes
- Monitoring system enabled hypervisor compromise
- No VM escape required
Impact: hypervisor compromise and ransomware encryption
| Product | Affected |
|---|---|
| VMware ESXi | — |
| Proxmox | — |
- Products
- ESXi
- Threat actors
- BlackNevasThe Gentlemen
- Organizations
- Kaspersky
From the original article
13 min read at securelist.com
A detailed breakdown of misconfigurations in virtual environment cybersecurity as shown by examples of ransomware cases on ESXi and Proxmox environments.
By Rauf Johari · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.