How BlackNevas and The Gentlemen Encrypted Entire VM Farms Without Breaking the Hypervisor
In two separate ransomware incidents investigated by Kaspersky GERT in 2025 and 2026, threat actors compromised VMware ESXi and Proxmox virtualization environments without exploiting any hypervisor escape vulnerability. In the first case, the BlackNevas ransomware group leveraged an overprivileged PRTG Network Monitor deployment that stored reusable root credentials, enabling SSH-based lateral movement across multiple ESXi hosts and full encryption of virtual workloads after disabling the execInstalledOnly security policy. In the second case, The Gentlemen ransomware group discovered plaintext administrative credentials stored in notes on a compromised sysadmin workstation, used them to authenticate as Proxmox root, activated VNC websockets, and encrypted the entire cluster. Both incidents resulted in widespread VM encryption and significant operational disruption. These incidents underscore a growing attacker pattern: ransomware operators are bypassing perimeter defenses entirely by targeting misconfigured management planes, reused privileged credentials, and flat administrative networks within virtualized infrastructure. As enterprise reliance on ESXi and Proxmox-based hyperconverged environments accelerates, the attack surface created by credential sprawl and insufficient network segmentation is becoming a primary ransomware kill chain—not a secondary one.
Kill Chain
