Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In two separate ransomware incidents investigated by Kaspersky GERT in 2025 and 2026, threat actors compromised VMware ESXi and Proxmox virtualization environments without exploiting any hypervisor escape vulnerability. In the first case, the BlackNevas ransomware group leveraged an overprivileged PRTG Network Monitor deployment that stored reusable root credentials, enabling SSH-based lateral movement across multiple ESXi hosts and full encryption of virtual workloads after disabling the execInstalledOnly security policy. In the second case, The Gentlemen ransomware group discovered plaintext administrative credentials stored in notes on a compromised sysadmin workstation, used them to authenticate as Proxmox root, activated VNC websockets, and encrypted the entire cluster. Both incidents resulted in widespread VM encryption and significant operational disruption.

These incidents underscore a growing attacker pattern: ransomware operators are bypassing perimeter defenses entirely by targeting misconfigured management planes, reused privileged credentials, and flat administrative networks within virtualized infrastructure. As enterprise reliance on ESXi and Proxmox-based hyperconverged environments accelerates, the attack surface created by credential sprawl and insufficient network segmentation is becoming a primary ransomware kill chain—not a secondary one.

Why This Matters Now

Ransomware groups are systematically targeting hypervisor management layers—ESXi, Proxmox, vCenter—because a single privileged credential compromise can encrypt hundreds of VMs simultaneously. With CVE-2025-22224 actively exploited in the wild and credential-based attacks requiring no zero-day, organizations running unsegmented virtualization stacks face existential recovery risk. Regulatory frameworks including PCI DSS 4.0 and NIST 800-53 now explicitly require segmented administrative access and privileged credential vaulting, raising compliance stakes alongside operational ones.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers used legitimate administrative credentials harvested from an overprivileged PRTG monitoring server and plaintext notes on a sysadmin workstation—no hypervisor escape or zero-day exploit was required. Reused root passwords and unrestricted SSH access provided direct management-plane entry to multiple hosts simultaneously.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to these incidents because both attacks succeeded entirely through unrestricted network reachability to management planes and credential reuse across flat infrastructure. Applying Zero Trust segmentation and identity-aware access controls would likely have reduced attacker reach into ESXi and Proxmox management surfaces before ransomware deployment could span the environment.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Micro-segmenting monitoring infrastructure away from hypervisor management planes would likely reduce the reachability of credential-bearing systems like PRTG from direct SSH or API access to ESXi and Proxmox hosts, limiting how quickly an attacker can pivot from a compromised monitoring node to the virtualization layer.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely reduce the scope of what an attacker can reach even after authenticating with valid root credentials, since network-layer policy enforcement could limit which source identities and workloads are permitted to communicate with hypervisor management APIs regardless of credential validity.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely limit an attacker's ability to freely SSH between ESXi nodes or reach additional Proxmox cluster members from an already-compromised host, reducing the scope of lateral movement by constraining which internal paths are permitted between management workloads and hypervisor nodes.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and traffic inspection controls would likely surface anomalous RMM tool communications originating from within the virtualized domain controller segment and could reduce the attacker's ability to maintain persistent operator sessions by flagging or constraining unexpected outbound connections from workloads that have no business initiating remote desktop traffic.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policy enforcement would likely reduce the available outbound paths for bulk data transfer, constraining any opportunistic exfiltration attempt by limiting which workloads can initiate large outbound flows to unexpected external destinations from within the hypervisor or VM segments.

Impact (Mitigations)

If prior Zero Trust segmentation had reduced lateral movement across ESXi nodes and Proxmox cluster members, the attacker's ability to reach every hypervisor host before deploying ransomware would likely have been constrained — reducing the number of systems encrypted and the overall blast radius of the impact stage rather than allowing full-environment encryption in a single coordinated execution.

Impact at a Glance

Affected Business Functions

  • Virtual Machine Workload Availability (ESXi and Proxmox hosted VMs)
  • Virtualization Management Plane and Administrative Console Access
  • Backup and Recovery Systems
  • Domain Controller and Identity Services (Windows AD in virtualized segment)
Operational Disruption

Estimated downtime: 18 days

Financial Impact

Estimated loss: N/A

Data Exposure

Full encryption of virtual machine disk files (VMDKs) and Proxmox cluster volumes across multiple hypervisor nodes rendered all hosted workloads unavailable. The compromised administrator workstation exposed plaintext privileged credentials, providing root-level access to the entire Proxmox cluster. Potential data categories at risk include virtual machine snapshots containing sensitive business data, credentials stored in monitoring platforms (PRTG), configuration files, logs, and any application-layer data hosted on the encrypted VMs such as internal databases, file shares, and domain controller artifacts. Anti-forensic log deletion on ESXi hosts further limits post-incident data recovery and forensic integrity. The scope of exposed data is consistent with a full enterprise virtual environment compromise.

Recommended Actions

  • • Apply Zero Trust Segmentation (microsegmentation) to isolate the hypervisor management plane — monitoring servers, backup systems, and administrative workstations should never have direct network reachability to ESXi SSH or Proxmox API endpoints without passing through an identity-verified, policy-enforced control point, preventing lateral credential reuse from spreading across nodes.
  • • Enforce East-West Traffic Security controls between virtual network segments so that workload-to-management-plane traffic is inspected and restricted by policy; had inter-segment filtering been applied, SSH movement from the monitoring subnet (192.168..) to production hypervisor hosts (172.16..) would have been blocked or alerted on before encryption executed.
  • • Deploy Multicloud Visibility and Control capabilities with centralized traffic observability to baseline normal administrative API call patterns; anomalous Proxmox VNC websocket API calls to multiple nodes within a short time window and unusual esxcli policy modification commands should trigger automated alerts enabling rapid incident response before ransomware detonation.
  • • Implement Egress Security and Policy Enforcement with FQDN filtering and outbound traffic controls to detect and block ransomware binary staging or C2 callback attempts from hypervisor hosts and administrative systems; egress policies would limit the attacker's ability to download ransomware payloads into the environment and prevent potential double-extortion data exfiltration channels.
  • • Leverage Inline IPS (Suricata-based) inspection on management network traffic paths to detect known ransomware payload signatures, exploit traffic patterns, and anomalous administrative tool execution such as GMER anti-rootkit usage, providing a detection layer that complements credential and segmentation controls and enabling earlier-stage intervention before ransomware reaches execution.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image