Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes

The BlackNevas ransomware group recently conducted a devastating attack on an organization's virtualization infrastructure, systematically destroying four ESXi hosts, all virtual machines, two vCenter Server Appliances, and connected backup infrastructure over a 10-day period. Notably, the attackers achieved this without exploiting any virtualization layer vulnerabilities, instead using legitimate VMware management interfaces to carry out their operations.

This attack represents a concerning trend in ransomware operations, particularly since the September 2021 leak of the Babuk ransomware source code, which included an ESXi version. At least ten subsequent ransomware families have leveraged this leaked code, enabling cybercriminals with limited technical expertise to develop ESXi-compatible ransomware lockers.

Hypervisor as prime target

Virtualization environments have become increasingly attractive targets for ransomware operators because they reduce the number of control points and enable broader impact. A compromise of the virtualization management plane gives attackers access to multiple hypervisor hosts, while direct impact on an ESXi datastore can render many guest systems unavailable simultaneously.

According to Kaspersky's global cybersecurity services report, ransomware accounted for 39.4% of incidents handled by their Global Emergency Response Team (GERT) in 2025, and data from early 2026 indicates this threat continues to grow. The accessibility of ESXi ransomware through leaked code has expanded the range of threat actors capable of targeting virtualization environments.

Visibility challenges

ESXi presents unique monitoring challenges as it's a specialized hypervisor based on VMware's proprietary VMkernel. Broadcom states that off-the-shelf security tools designed for general-purpose operating systems cannot run on ESXi without workarounds, and direct installation of third-party agents or antiviruses on ESXi and vCenter Server Appliance is not supported.

This creates a visibility asymmetry where guest operating systems protected by EDR software cannot directly observe or attribute hypervisor processes that modify virtual machine disks or related datastore files. In the examined incident, host-native and management-plane telemetry were central to reconstructing the incident timeline.

Attack paths

Attackers use multiple routes to reach virtualization infrastructure, including vulnerability exploitation, credential reuse, Active Directory integration abuse, and backup infrastructure as a credential bridge. In the analyzed incident, no ESXi vulnerabilities were used as the initial access path, though public vulnerabilities remain important entry points.