[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fe73ra-pRxGrkq7zwvseKZZrriFnRXtxkHWcvmx_A26o":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"16026632-9c2b-491b-aa25-e5199ed91ac7","Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes","ransomware-at-the-hypervisor-layer-how-attackers-use-esxi-and-vcenter-features-f-365656","Kaspersky experts analyze a recent ransomware incident and discuss why the hypervisor layer remains difficult to monitor, what common access paths adversaries use to reach it, and how to protect your ESXi systems.","Kaspersky experts investigated a ransomware incident where the BlackNevas group targeted VMware ESXi hosts, virtual machines, vCenter Server Appliances, and backup infrastructure over 10 days. The attack did not exploit virtualization layer vulnerabilities but instead used legitimate VMware management interfaces and Babuk ransomware-derived code. The attackers focused on destroying backup infrastructure before encrypting systems, highlighting the challenges in monitoring the hypervisor layer.","BlackNevas ransomware group targets VMware ESXi and vCenter, destroying VMs and backups.","https:\u002F\u002Fsecurelist.com\u002Fesxi-ransomware\u002F121959\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F11\u002F12200032\u002Fesxi-3_securelist-featured_1200x600_x2.jpg","2026-11-13T09:00:43+00:00","2026-11-13T10:00:37.973482+00:00",8,[17,20,23,26],{"name":18,"type":19},"BlackNevas","threat_actor",{"name":21,"type":22},"VMware","vendor",{"name":24,"type":25},"ESXi","product",{"name":27,"type":25},"vCenter","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":28,"icon":30,"name":31,"slug":32},null,"Ransomware","ransomware",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":53,"value":54,"context":55},"malware","Babuk","Leaked ransomware source code used by multiple families targeting ESXi.",[21,24,27],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":89,"name":90,"problem":91,"products":92},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":118,"name":119,"problem":120,"products":121},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":157},"ransomware-groups-weaponize-legitimate-vmware-tools-to-destroy-backups-before-encrypting","Ransomware Groups Weaponize Legitimate VMware Tools to Destroy Backups Before Encrypting","The BlackNevas group spent 10 days quietly moving through VMware ESXi and vCenter environments using native management interfaces — not exploits — to map and destroy backup infrastructure before triggering Babuk-derived ransomware. Because the attackers relied on legitimate VMware features, traditional signature-based detection largely failed to flag their activity. The deliberate destruction of backups before encryption is a calculated tactic to eliminate recovery options and maximize ransom leverage. This incident exposes a critical blind spot: hypervisor and virtualisation management layers are rarely monitored with the same rigor as endpoint or network layers, making them attractive staging grounds for attackers who have already obtained valid credentials.",[152,153,154,155,156],"MITRE ATT&CK T1490: Inhibit System Recovery","CIS Control 11: Data Recovery","CIS Control 8: Audit Log Management","NIST SP 800-53 AU-2: Event Logging","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":158,"CIS Control 11: Data Recovery":159,"NIST SP 800-53 AU-2: Event Logging":160,"CIS Control 8: Audit Log Management":161,"MITRE ATT&CK T1490: Inhibit System Recovery":162},"This point requires human resources security, access control, and asset management practices; the attack succeeded by abusing legitimate management credentials and interfaces, indicating insufficient access control over privileged virtualisation accounts.","CIS Control 11 requires that backup data be protected against modification and deletion; the attackers' ability to destroy backup infrastructure demonstrates this control was not in place for the virtualisation environment.","AU-2 requires that organisations identify and log security-relevant events on all systems, including management interfaces; absence of adequate ESXi and vCenter event logging enabled the attackers to operate undetected.","CIS Control 8 mandates collecting and reviewing logs from all enterprise assets; the article explicitly notes that monitoring the hypervisor layer was insufficient, allowing 10 days of attacker activity to go undetected.","The attackers deliberately targeted and destroyed backup infrastructure before encrypting systems, which is precisely the behaviour T1490 describes — removing recovery mechanisms to prevent restoration without paying ransom."]