Kaspersky GERT investigated two ransomware cases targeting ESXi and Proxmox environments, finding that misconfigurations like reused root passwords and plain-text credential notes enabled broad system compromise.
ESXi Attack Path and Monitoring
Kaspersky GERT investigated an incident involving BlackNevas ransomware where an attacker utilized PRTG Network Monitor access to ESXi hosts. The environment shared the same root password across several nodes, allowing the threat actor to connect over SSH.
After obtaining access, the attacker bypassed system restrictions by deactivating the execInstalledOnly policy to execute the encryption binary and clear logs.
Proxmox Incident and Credential Exposure
In a separate response to an incident by The Gentlemen group, attackers gained access to Proxmox using administrative credentials stored in plain-text notes on a compromised administrator workstation.
The actor activated the VNC web socket through the compromised root account to gain control over the Proxmox environment and execute ransomware within the cluster.
What to do
- Separate monitoring from administration by creating a dedicated monitoring identity for each platform and restricting it to required permissions.
- Replace stored root passwords in monitoring tools, scripts, and scheduled tasks with vault retrieval or limited API tokens.
- Restrict direct host access by routing normal ESXi administration through vCenter and keeping SSH and the ESXi Shell stopped by default.
- Store privileged credentials in an approved password manager or privileged access management system rather than unsecured notes.
Key facts and where they come from
- Kaspersky GERT investigated two ransomware cases on ESXi and Proxmox environments.
Kaspersky GERT recently investigated two more ransomware cases on ESXi and Proxmox environments
- In the ESXi case, the PRTG monitoring deployment had broad access and root passwords were reused.
the PRTG deployment had broad access to the ESXi hosts and that the same root password was reused across several nodes.
- In the Proxmox case, the threat actor found administrative credentials stored in notes in plain text.
discovered administrative credentials and access details stored in notes in plain text.
The open question: Can virtualization monitoring platforms ever be safely configured with direct host root access without creating a critical lateral movement path for attackers?
Tell us what you think · Discuss it in the Threat Intel room
