Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes

The BlackNevas group spent 10 days quietly moving through VMware ESXi and vCenter environments using native management interfaces — not exploits — to map and destroy backup infrastructure before triggering Babuk-derived ransomware. Because the attackers relied on legitimate VMware features, traditional signature-based detection largely failed to flag their activity. The deliberate destruction of backups before encryption is a calculated tactic to eliminate recovery options and maximize ransom leverage. This incident exposes a critical blind spot: hypervisor and virtualisation management layers are rarely monitored with the same rigor as endpoint or network layers, making them attractive staging grounds for attackers who have already obtained valid credentials.