Virtualization security: attack layers and misconfiguration impact
Ransomware attacks exploit ESXi and Proxmox misconfigurations, highlighting risks in virtualization environments.
Run Kaspersky?
Get an email when a reviewed story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Kaspersky GERT investigated two ransomware cases targeting ESXi and Proxmox environments, identifying misconfigurations like weak access controls, credential reuse, and overprivileged monitoring accounts as key attack vectors. The incidents demonstrate that even patched hypervisors are vulnerable if administrative credentials or access paths are insecure, emphasizing the need for secure configuration alongside patching.
The lesson from this incident
Full lessonTwo ransomware incidents investigated by Kaspersky GERT revealed that attackers successfully compromised ESXi and Proxmox hypervisors not by exploiting unpatched software, but by abusing weak access controls, credential reuse, and overprivileged monitoring accounts. This highlights a critical blind spot in many organizations: patching alone is insufficient if the surrounding configuration posture is insecure. Overprivileged service accounts and reused credentials provide attackers with high-value lateral movement paths directly into virtualization infrastructure that hosts many critical workloads simultaneously. The business impact is severe—a single compromised hypervisor can encrypt dozens of virtual machines in minutes, making these environments a prime ransomware target.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
- malware — BlackNevas
- malware — AnyDesk
- malware — GMER