BlackNevas wiped an ESXi estate through VMware management tools

Kaspersky says BlackNevas destroyed four ESXi hosts, every guest, both vCenters and backups in 10 days without a hypervisor exploit.

Kaspersky’s Global Emergency Response Team investigated a BlackNevas ransomware intrusion that destroyed an organization’s virtualization estate through legitimate VMware management interfaces. Over 10 days the attackers hit four ESXi hosts, every guest, both vCenter Server Appliances and connected backups. No guest-to-host escape or hypervisor memory corruption was used. Ransom notes named BlackNevas, a group Kaspersky first observed in November 2024. The write-up ties broader ESXi locker availability to the September 2021 Babuk source leak and notes guest EDR cannot see datastore encryption performed by the hypervisor.