Ransomware Groups Weaponize Legitimate VMware Tools to Destroy Backups Before Encrypting
Written by AI from the linked story. Not reviewed by an editor. How this works
The BlackNevas group spent 10 days quietly moving through VMware ESXi and vCenter environments using native management interfaces — not exploits — to map and destroy backup infrastructure before triggering Babuk-derived ransomware. Because the attackers relied on legitimate VMware features, traditional signature-based detection largely failed to flag their activity. The deliberate destruction of backups before encryption is a calculated tactic to eliminate recovery options and maximize ransom leverage. This incident exposes a critical blind spot: hypervisor and virtualisation management layers are rarely monitored with the same rigor as endpoint or network layers, making them attractive staging grounds for attackers who have already obtained valid credentials.
Tactical Insight
Immediate actions
- Isolate vCenter Server and ESXi management interfaces from general corporate networks and restrict access to a dedicated, monitored management VLAN.
- Audit all accounts with access to VMware management interfaces and remove or disable any that are unnecessary, stale, or overly privileged.
- Verify that backup targets are immutable and stored offline or out-of-band so they cannot be reached from the hypervisor management plane.
Detection measures
- Enable and centralise logging of all VMware vCenter and ESXi management API calls, authentication events, and VM snapshot/deletion operations in a SIEM.
- Configure alerts for anomalous hypervisor-layer actions such as bulk VM power-offs, snapshot deletions, or backup job terminations outside of maintenance windows.
- Implement integrity monitoring on backup infrastructure so that any unexpected deletion or modification triggers an immediate alert.
Long-term improvements
- Enforce multi-factor authentication on all VMware management interfaces, including vCenter, ESXi host clients, and any connected backup consoles.
- Apply the principle of least privilege across the entire virtualisation stack, using role-based access control to limit who can delete VMs, snapshots, or modify backup schedules.
- Conduct regular tabletop exercises and purple-team drills that specifically simulate hypervisor-layer attacks to identify monitoring and response gaps before attackers do.