# Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes

Source: [Securelist](https://securelist.com/esxi-ransomware/121959/) · 2026-11-13 · Security
Page: https://themorning.dev/story/ransomware-at-the-hypervisor-layer-how-attackers-use-esxi-and-vcenter-features-f-b955104ed90db8b9
Kind: security · Impact: high

## In brief

- Securelist's GERT team investigated an engagement in which an adversary destroyed an organization's virtualization estate over a 10-day period.
- The campaign targeted four ESXi hosts, every virtual machine hosted on them, and both vCenter Server Appliances.
- The attack used legitimate ESXi and vCenter features for malicious purposes.

## Why it matters

Attackers can use built-in ESXi and vCenter functionality to destroy entire virtualized environments, so hypervisor management interfaces and their access controls need the same protection as production workloads.

## Timeline

- 2026-11-13: Securelist publishes report on the ESXi and vCenter ransomware investigation

## Coverage

- [Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes](https://securelist.com/esxi-ransomware/121959/) — Securelist, 2026-11-13

Tags: ransomware, esxi, vcenter, virtualization, incident-response

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev