Security · High impactFan score 64 · Tier A
Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes
Securelist · By Elsayed Elrefaei & Mohamed Ghobashy ·
The Brief
- Securelist's GERT team investigated an engagement in which an adversary destroyed an organization's virtualization estate over a 10-day period.
- The campaign targeted four ESXi hosts, every virtual machine hosted on them, and both vCenter Server Appliances.
- The attack used legitimate ESXi and vCenter features for malicious purposes.
Why it matters
Attackers can use built-in ESXi and vCenter functionality to destroy entire virtualized environments, so hypervisor management interfaces and their access controls need the same protection as production workloads.
Who’s affected
- Teams running VMware ESXi hosts and vCenter Server
- #ransomware
- #esxi
- #vcenter
- #virtualization
- #incident-response
Our Global Emergency Response Team (GERT) recently investigated an engagement in which an adversary destroyed an organization’s virtualization estate over a 10-day period. The campaign targeted four ESXi hosts, every virtual machine hosted on them, both vCenter Server Appliances…
Timeline
Securelist publishes report on the ESXi and vCenter ransomware investigation
Securelist
Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes