BlackNevas Ransomware Attacks VMware ESXi Servers, Destroying Virtual Machines and Backup Infrastructure
BlackNevas Ransomware Attacks VMware ESXi Servers, Destroying Virtual Machines and Backup Infrastructure
A newly disclosed intrusion in which the BlackNevas group destroyed an organization’s entire virtualization estate over 10 days. Kaspersky’s Global Emergency Response Team (GERT) documented the attackers wiped four ESXi hosts, every virtual machine on them, both vCenter Server Appliances (VCSA) and all connected…
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-64393 | SYSTEM code execution via Backup Viewer in Veeam Backup | 9.4 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cloudvflare.com | binary sat under /opt/vmware/bin/agent and beaconed to api.cloudvflare[.]com:443. The unit used a VMware-style description and Restart |
| ipv4 | 188.240.57.94 | used for initial portal access High Incident-specific IPv4 188.240.57[.]94 VPS used for initial portal access High Incident-specific |
| ipv4 | 31.41.33.212 | used for initial portal access High Incident-specific IPv4 31.41.33[.]212 VPS used for initial portal access High Incident-specific |
| ipv4 | 45.149.154.135 | ter typosquat of cloudflare.com High Incident-specific IPv4 45.149.154[.]135 Remote-management agent C2 High Incident-specific IPv4 91 |
| ipv4 | 91.92.242.121 | ]135 Remote-management agent C2 High Incident-specific IPv4 91.92.242[.]121 VPS used for initial portal access High Incident-specific |
| sha1 | 28f8da19ddcdf26e426875c7a834b34a79bc1c33 | used for initial portal access High Incident-specific SHA-1 28f8da19ddcdf26e426875c7a834b34a79bc1c33 svhost.exe / lock.exe High Sample-specific SHA-256 15dc419b |
| sha256 | 15dc419b7fbeb50c50820a7cd27997541deafa4fa710f074bb657f0149574baf | 79bc1c33 svhost.exe / lock.exe High Sample-specific SHA-256 15dc419b7fbeb50c50820a7cd27997541deafa4fa710f074bb657f0149574baf Remote-management agent High Sample-specific SHA-256 5a9b7a |
| sha256 | 5a9b7a0d3f25757aea957713d7e84cabec87597b3474368328a8fd5ed7a12f78 | 574baf Remote-management agent High Sample-specific SHA-256 5a9b7a0d3f25757aea957713d7e84cabec87597b3474368328a8fd5ed7a12f78 Installed remote-management agent variant High Sample-speci |
From the original article
5 min read at gbhackers.com
A newly disclosed intrusion in which the BlackNevas group destroyed an organization’s entire virtualization estate over 10 days. Kaspersky’s Global Emergency Response Team (GERT) documented the attackers wiped four ESXi hosts, every virtual machine on them, both vCenter Server Appliances (VCSA) and all connected backup infrastructure. They exploited no hypervisor flaw, guest-to-host escape, or memory […]
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.