[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0pB5RJIK8GEJ88g_DXdnTCoYjvLBodi4QHIFMIvom2A":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"72641c6d-6f71-482b-b213-180f29bcaf61","ransomware-groups-weaponize-legitimate-vmware-tools-to-destroy-backups-before-encrypting","16026632-9c2b-491b-aa25-e5199ed91ac7","Ransomware Groups Weaponize Legitimate VMware Tools to Destroy Backups Before Encrypting","The BlackNevas group spent 10 days quietly moving through VMware ESXi and vCenter environments using native management interfaces — not exploits — to map and destroy backup infrastructure before triggering Babuk-derived ransomware. Because the attackers relied on legitimate VMware features, traditional signature-based detection largely failed to flag their activity. The deliberate destruction of backups before encryption is a calculated tactic to eliminate recovery options and maximize ransom leverage. This incident exposes a critical blind spot: hypervisor and virtualisation management layers are rarely monitored with the same rigor as endpoint or network layers, making them attractive staging grounds for attackers who have already obtained valid credentials.","**Immediate actions:**\n- Isolate vCenter Server and ESXi management interfaces from general corporate networks and restrict access to a dedicated, monitored management VLAN.\n- Audit all accounts with access to VMware management interfaces and remove or disable any that are unnecessary, stale, or overly privileged.\n- Verify that backup targets are immutable and stored offline or out-of-band so they cannot be reached from the hypervisor management plane.\n\n**Detection measures:**\n- Enable and centralise logging of all VMware vCenter and ESXi management API calls, authentication events, and VM snapshot\u002Fdeletion operations in a SIEM.\n- Configure alerts for anomalous hypervisor-layer actions such as bulk VM power-offs, snapshot deletions, or backup job terminations outside of maintenance windows.\n- Implement integrity monitoring on backup infrastructure so that any unexpected deletion or modification triggers an immediate alert.\n\n**Long-term improvements:**\n- Enforce multi-factor authentication on all VMware management interfaces, including vCenter, ESXi host clients, and any connected backup consoles.\n- Apply the principle of least privilege across the entire virtualisation stack, using role-based access control to limit who can delete VMs, snapshots, or modify backup schedules.\n- Conduct regular tabletop exercises and purple-team drills that specifically simulate hypervisor-layer attacks to identify monitoring and response gaps before attackers do.",[12,13,14,15,16],"MITRE ATT&CK T1490: Inhibit System Recovery","CIS Control 11: Data Recovery","CIS Control 8: Audit Log Management","NIST SP 800-53 AU-2: Event Logging","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":18,"CIS Control 11: Data Recovery":19,"NIST SP 800-53 AU-2: Event Logging":20,"CIS Control 8: Audit Log Management":21,"MITRE ATT&CK T1490: Inhibit System Recovery":22},"This point requires human resources security, access control, and asset management practices; the attack succeeded by abusing legitimate management credentials and interfaces, indicating insufficient access control over privileged virtualisation accounts.","CIS Control 11 requires that backup data be protected against modification and deletion; the attackers' ability to destroy backup infrastructure demonstrates this control was not in place for the virtualisation environment.","AU-2 requires that organisations identify and log security-relevant events on all systems, including management interfaces; absence of adequate ESXi and vCenter event logging enabled the attackers to operate undetected.","CIS Control 8 mandates collecting and reviewing logs from all enterprise assets; the article explicitly notes that monitoring the hypervisor layer was insufficient, allowing 10 days of attacker activity to go undetected.","The attackers deliberately targeted and destroyed backup infrastructure before encrypting systems, which is precisely the behaviour T1490 describes — removing recovery mechanisms to prevent restoration without paying ransom.","published","2026-11-13T11:22:12.393751+00:00","2026-11-13T11:22:12.372+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsecurelist.com\u002Fesxi-ransomware\u002F121959\u002F","ransomware-at-the-hypervisor-layer-how-attackers-use-esxi-and-vcenter-features-f-365656","Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8ff5d73-dec9-4911-88ee-ed016a89f3f4","Backup & Recovery","backup-recovery","No backups, untested recovery, ransomware impact","#f43f5e",[],[51,55,59],{"slug":52,"name":53,"problem":54},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":56,"name":57,"problem":58},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":60,"name":61,"problem":62},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back."]