Virtualization security: attack layers and misconfiguration impact
Kaspersky researchers investigated two ransomware attacks on ESXi and Proxmox virtual environments where weak access controls and poor credential management led to full system compromise.
Virtualization environments face significant security risks when misconfigurations create pathways for attackers to escalate privileges and deploy ransomware. Kaspersky researchers recently documented two ransomware cases on ESXi and Proxmox platforms where weak access controls, insufficient network separation, and poor credential management led to complete system compromise. These incidents demonstrate that even fully patched hypervisors can be vulnerable when security best practices are not followed.
The first case involved BlackNevas ransomware exploiting a monitoring system with excessive privileges. The attacker gained access through a PRTG Network Monitor deployment that held root credentials for multiple ESXi hosts. Using these credentials, the actor connected via SSH to the hosts, uploaded malware, and disabled security restrictions to execute the encryption binary and delete forensic logs. The timeline shows how the attacker first encountered an execution restriction but quickly bypassed it by changing security settings.
Credential storage risks
The second case involved The Gentlemen ransomware group compromising a Proxmox environment after discovering administrative credentials stored in plain text on a compromised administrator workstation. These credentials allowed the attacker to activate VNC web sockets and gain control over the entire virtual environment, leading to encryption of all virtual machines. The log records show multiple VNC websocket connections being established using the root account across different hosts.
This incident is a clear example of the risks of storing privileged credentials in unsecured notes or other easily accessible files. Once the administrator workstation was compromised, the saved credentials allowed the actor to move from a single endpoint into the virtualization management layer.
Common misconfigurations
Both cases revealed critical misconfigurations that enabled broad impact. The monitoring system in the first case inherited excessive privileges, while credential reuse allowed one compromised secret to provide access across the entire environment. Direct root access bypassed central controls, and lack of enhanced security settings provided only minimal resistance. These findings align with NIST guidance that places secure configuration baselines, restricted administrative access, current patches, and monitoring as essential security practices.
The incidents underscore why virtualization security requires a comprehensive approach. Organizations must implement dedicated monitoring identities with minimal necessary permissions, unique credentials for each host, proper password storage systems, and hardening measures like disabling SSH during normal operation. Broadcom recommends managing vSphere through vCenter and enabling additional protections like UEFI Secure Boot and TPM-backed configuration protection.
Related
