[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$funDdfRqkVpBpffo9w4HeNtdmZL0lKLh7mFqesyxjxuo":3},{"article":4,"iocs":48,"watch_terms":58,"solutions":59,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"595bedfd-3161-4bce-ab68-473b8714b17c","Virtualization security: attack layers and misconfiguration impact","virtualization-security-attack-layers-and-misconfiguration-impact-62fe0f","A detailed breakdown of misconfigurations in virtual environment cybersecurity as shown by examples of ransomware cases on ESXi and Proxmox environments.","Kaspersky GERT investigated two ransomware cases targeting ESXi and Proxmox environments, identifying misconfigurations like weak access controls, credential reuse, and overprivileged monitoring accounts as key attack vectors. The incidents demonstrate that even patched hypervisors are vulnerable if administrative credentials or access paths are insecure, emphasizing the need for secure configuration alongside patching.","Ransomware attacks exploit ESXi and Proxmox misconfigurations, highlighting risks in virtualization environments.","https:\u002F\u002Fsecurelist.com\u002Fvirtualization-security-esxi-and-proxmox-ransomware-cases\u002F121819\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F11\u002F06081025\u002Fvirtualization-security-featured-image.jpg","2026-11-06T10:00:12+00:00","2026-11-06T11:00:28.329665+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"ESXi","product",{"name":21,"type":19},"Proxmox",{"name":23,"type":19},"PRTG Network Monitor",{"name":25,"type":26},"Kaspersky","vendor",{"name":28,"type":29},"Virtualization","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[49,52,55],{"type":47,"value":50,"context":51},"BlackNevas","Ransomware family identified in Case #1",{"type":47,"value":53,"context":54},"AnyDesk","Remote monitoring tool used by attackers in Case #1",{"type":47,"value":56,"context":57},"GMER","Binary executed by attackers in Case #1",[25,18,21],{"controls":60,"vendors":136},[61,89,110],{"slug":62,"name":63,"problem":64,"products":65},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":62,"product_name":86,"url":87,"description":88},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[94,102],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":111,"name":112,"problem":113,"products":114},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[115,123,128],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":124,"product_name":125,"url":126,"description":127},"zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"esxi-proxmox-ransomware-misconfigurations-open-the-door-even-on-patched-hypervisors","ESXi & Proxmox Ransomware: Misconfigurations Open the Door Even on Patched Hypervisors","Two ransomware incidents investigated by Kaspersky GERT revealed that attackers successfully compromised ESXi and Proxmox hypervisors not by exploiting unpatched software, but by abusing weak access controls, credential reuse, and overprivileged monitoring accounts. This highlights a critical blind spot in many organizations: patching alone is insufficient if the surrounding configuration posture is insecure. Overprivileged service accounts and reused credentials provide attackers with high-value lateral movement paths directly into virtualization infrastructure that hosts many critical workloads simultaneously. The business impact is severe—a single compromised hypervisor can encrypt dozens of virtual machines in minutes, making these environments a prime ransomware target.",[142,143,144,145,146,147,148],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 12: Network Infrastructure Management","MITRE ATT&CK T1078: Valid Accounts","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":150,"MITRE ATT&CK T1078: Valid Accounts":151,"NIST SP 800-53 SI-2: Flaw Remediation":152,"CIS Control 12: Network Infrastructure Management":153,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":154,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"NIS2 requires essential and important entities to implement incident handling and access control policies; the credential reuse and overprivileged account failures in these cases represent exactly the access control gaps NIS2 mandates organizations to prevent.","The attackers used legitimate but overprivileged or reused credentials to authenticate to the hypervisor environments, which maps directly to this technique and underscores the need for credential hygiene and privileged account monitoring.","While the hypervisors were patched, the broader principle applies: SI-2 emphasizes that remediation extends beyond patches to include secure configuration, reinforcing that organizations must address all identified weaknesses, not just software vulnerabilities.","Hypervisor management interfaces were accessible beyond secure administrative boundaries; CIS Control 12 requires restricting and protecting network access to management planes, which would have limited attacker reach to the virtualization layer.","This control requires organizations to identify and address technical vulnerabilities including misconfigurations, not just unpatched software, making it directly applicable to the configuration-driven compromise seen in these incidents.","The root cause of both incidents was misconfigured hypervisors; CIS Control 4 mandates establishing and maintaining secure configuration baselines for all enterprise assets, which would have closed the weak-configuration attack vectors exploited here.","Attackers leveraged credential reuse and overprivileged accounts to gain access; this framework function requires enforcing least-privilege access and strong authentication, directly addressing those weaknesses."]