ESXi ransomware: why it is dangerous and how to defend against it

A ransomware campaign by the BlackNevas group targeted VMware ESXi environments by compromising four ESXi hosts, all virtual machines, vCenter Server Appliances, and backup infrastructure over ten days. The attackers used legitimate VMware management interfaces without exploiting software vulnerabilities, gaining access via compromised credentials from non-virtualization systems. They established persistence on vCenter appliances using MeshAgent and Ligolo-ng, enabled SSH on ESXi hosts via Host Profiles, and delivered ransomware payloads through SFTP to selectively overwrite virtual disk files. Backup systems were disrupted first to prevent recovery. This attack highlights the severe risk posed by hypervisor compromise through valid credentials and administrative features, emphasizing the need for architectural defenses such as treating vCenter as Tier 0 assets and separating virtualization identities from enterprise administration.

• Toy Ghouls’ new toy: the GenieLocker ransomwareMalware2026-07-30
• Angry Birds: Toy Ghouls’ new toysMalware2026-09-04
• GOLD SALEM tradecraft for deploying Warlock ransomwareMalware2025-12-11
• LockBit strikes with new 5.0 version, targeting Windows, Linux and ESXI systemsCampaign2026-02-12
• A New ESXi Implant Linked to Settra RansomwareMalware2026-11-10