Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes
BlackNevas ransomware group targets VMware ESXi and vCenter, destroying VMs and backups.
Kaspersky experts investigated a ransomware incident where the BlackNevas group targeted VMware ESXi hosts, virtual machines, vCenter Server Appliances, and backup infrastructure over 10 days. The attack did not exploit virtualization layer vulnerabilities but instead used legitimate VMware management interfaces and Babuk ransomware-derived code. The attackers focused on destroying backup infrastructure before encrypting systems, highlighting the challenges in monitoring the hypervisor layer.
AI summary of the linked source. Not reviewed by an editor. How this works
Run VMware?
Get an email when a new story names VMware, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Babuk