Ransomware Attacks Exploit Virtualization Misconfigurations, Weak Access Controls
Kaspersky GERT investigated two ransomware incidents impacting ESXi and Proxmox virtual environments, highlighting how misconfigurations and weak access controls enable attackers to compromise hosts without exploiting hypervisor vulnerabilities.
Kaspersky's Global Emergency Response Team (GERT) has investigated two recent ransomware incidents that targeted virtualized environments running VMware ESXi and Proxmox. These attacks underscore a critical security principle: even fully patched hypervisors remain vulnerable if underlying infrastructure and access controls are weak. The investigations revealed that attackers successfully compromised these environments not by exploiting hypervisor vulnerabilities or performing VM escapes, but by leveraging common security misconfigurations, insufficient network segmentation, exposed administrative services, and the reuse of privileged credentials.
A significant factor in both incidents was the compromise of systems that had broad access to the virtualization layer. In one case, a network monitoring system, PRTG Network Monitor, was configured with administrative credentials for ESXi hosts. This setup inadvertently created a single, potent attack path: compromising the monitoring system provided attackers with the necessary credentials to directly administer the ESXi hosts via SSH. The attackers then used the esxcli command to disable security policies, allowing them to execute ransomware and cover their tracks by deleting logs.
The second incident involved the Proxmox environment, where attackers gained access by discovering plain-text administrative credentials and access details stored in notes on a compromised administrator workstation. This information allowed them to log in to Proxmox as root. Once inside, they activated the VNC web socket, granting them extensive control over the entire Proxmox environment, which was then used to deploy ransomware.
These cases highlight the interconnected nature of modern IT infrastructure. A virtual environment is not merely the hypervisor itself but a complex stack including management consoles, orchestration tools, monitoring platforms, and automation accounts. Attackers only need to find one viable route, which can be as simple as a stolen or insecurely stored administrator credential, an overprivileged monitoring account, or an exposed SSH port. The security of the entire system depends on securing the boundaries between these components, not just the guest-to-host relationship.
Kaspersky GERT emphasizes that secure configuration must be managed in tandem with patching. A system that is up-to-date with security patches can still be compromised if administrative interfaces are exposed, credentials are weak or reused, or monitoring tools possess excessive privileges. This aligns with NIST guidance, which advocates for secure configuration baselines, restricted administrative access, up-to-date patches, and comprehensive monitoring across all layers of the IT stack.
To mitigate these risks, organizations should implement robust credential management practices, including avoiding password reuse and using strong, unique passwords for all administrative accounts. Network segmentation is crucial to limit the blast radius of a compromise, ensuring that monitoring systems and administrative interfaces are not accessible from general server networks. Regularly auditing access controls and privileges for all systems, especially those with elevated access like monitoring platforms, is also essential.
Furthermore, organizations should adopt a defense-in-depth strategy that includes securing the management plane, monitoring systems, and storage layers, in addition to the virtual machines themselves. Implementing least privilege principles for all accounts and services, and regularly reviewing security configurations against established baselines, can significantly reduce the attack surface. The incidents involving ESXi and Proxmox serve as a stark reminder that comprehensive security requires attention to both software vulnerabilities and the fundamental security hygiene of the entire IT ecosystem.