A ransomware operation targeted four ESXi hosts, their virtual machines, two vCenter appliances and connected backup infrastructure over ten days, according to a November 13 case study from Kaspersky’s Global Emergency Response Team.
Investigators found no exploitation of virtualization-layer vulnerabilities in this incident. Credentials obtained elsewhere in the organization provided access to vCenter, where attackers abused Host Profiles, a legitimate configuration-management feature, to enable SSH on ESXi hosts.
Before the final ESXi attack, the adversary disabled backup-environment antivirus, stopped backup services, encrypted recovery infrastructure and disrupted administrative access. That sequence weakened restoration options before production suffered its final impact.
Ransom notes named BlackNevas, but researchers lacked the ESXi encryptor binary, limiting direct malware attribution.
The defensive priority is to separate virtualization and recovery administration from ordinary enterprise credentials, restrict management access and preserve independent logs. Patching remains necessary, while compromised administrative authority can still undermine host protections.
