Change language to
English
Español
Русский
中文
العربية
Kaspersky says two recent ransomware attacks on ESXi and Proxmox virtual servers didn’t need a hypervisor flaw. The attackers got in through a reused root password and admin notes left in plain text.
ESXi and Proxmox are the systems companies use to run many servers and workloads on shared hardware. For anyone running them, the lesson is uncomfortable: a fully patched host still falls if the passwords around it are weak. Kaspersky’s Global Emergency Response Team (GERT) investigated both cases. Its full report on Securelist says no VM escape was required. In a VM escape, code inside a virtual machine breaks out to affect the host or other machines.
The first case, in October 2025, involved BlackNevas ransomware on ESXi. The attacker compromised a monitoring environment running PRTG Network Monitor, with broad access to the ESXi hosts. Traces on a Windows system pointed to the remote access tool AnyDesk and GMER, a tool often used to inspect low-level system activity. Kaspersky found the same root password reused across several nodes, and the attacker used it to log in to ESXi hosts over SSH.
ESXi did push back at first. When the attacker uploaded a file named esx and tried to run it, the host blocked it with the message “Execution of non-installed file prevented.” With root access, though, the attacker changed the system settings, ran the encryption malware, and deleted logs.
In August 2026, The Gentlemen ransomware hit a Proxmox environment. On a compromised administrator workstation, the attacker found credentials and access details stored in notes, then logged in to Proxmox as root. Next, the attacker switched on the VNC web socket, a browser-based remote console, and used it to download and run ransomware across the cluster.
These cases show that defenders need to treat monitoring platforms, administrator workstations and management networks as part of the virtualization attack surface. They also show why patching alone is not enough.
Rauf Johari, Kaspersky GERT expert
Kaspersky’s recommendations centre on access control:
Isolate virtualisation management systems from the general server network.
Stop routinely using and storing shared or reusable privileged credentials.
Keep admin access to the minimum, including for monitoring accounts.
Apply least privilege to administrator workstations.
Harden and monitor systems that can reach the virtualisation hosts.
Kaspersky also suggests its own products, including Kaspersky Next and its Managed Detection and Response and Incident Response services. Kaspersky hasn’t said which organisations were hit. Still, the ESXi case holds an awkward detail for IT teams: the safeguard worked as designed, but the attacker’s root access was enough to switch it off.
Click Here For The Original Source.
——————————————————–
