International
The Morning Dev

Only the news worth knowing

‹
 
A64/100

Malware · high

Ransomware at the hypervisor layer via ESXi and vCenter features

Tier A · Patch today – Before you go home

Who’s exposed: Organizations running ESXi hosts and vCenter Server Appliances

Tier A because: Core infrastructure or popular tool AND exploited in the wild

Reach

Attack

Damage

Fix

Popular tool · Exploited in the wild

The Brief

  • Securelist's GERT team investigated an engagement in which an adversary destroyed an organization's virtualization estate over a 10-day period.
  • The campaign targeted four ESXi hosts, every virtual machine hosted on them, and both vCenter Server Appliances.
  • The attack used legitimate ESXi and vCenter features for malicious purposes.

Why it matters

Attackers can use built-in ESXi and vCenter functionality to destroy entire virtualized environments, so hypervisor management interfaces and their access controls need the same protection as production workloads.

The checklist behind the tier

Checklist · 3 of 10 yes
YesHits tech teamsESXi and vCenter are enterprise virtualization software run by IT and ops teams.
NoCore infrastructureA single vendor's virtualization product, not software nearly every team runs like OpenSSH or the Linux kernel.
YesPopular toolESXi and vCenter are widely deployed enterprise virtualization platforms.
YesExploited in the wildSecurelist: GERT investigated an engagement where an adversary destroyed an organization's virtualization estate over 10 days.
NoPublic exploitSecurelist excerpt mentions no published exploit code or proof-of-concept.
NoRemote, no loginSecurelist excerpt does not state how the attacker gained access or whether authentication was needed.
NoFull takeoverSecurelist excerpt does not explicitly state code execution or admin rights; only that the estate was destroyed.
NoSecrets exposedSecurelist excerpt does not mention stolen credentials, keys, configs or data exposure.
NoSupply chainSecurelist describes an attack on an organization's hosts and appliances, not a compromised package or update channel.
NoNo fix yetSecurelist excerpt does not mention whether a patch or fix is available.

Timeline

  1. Securelist publishes report on the ESXi and vCenter ransomware investigation

  2. Securelist

    Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes

Source

Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes ↗ Securelist · 3h ago

First seen · 1 source · Full story page · How tiers are decided