Kaspersky Global Emergency Response Team found that recent ransomware attacks on ESXi and Proxmox virtualized environments — the systems companies use to run and manage multiple servers and workloads on shared infrastructure — did not rely on VM escape. Instead, attackers reached and encrypted virtual infrastructure by exploiting weak administrative controls, reused root credentials and poor security practices around monitoring systems and administrator workstations.
Based on its research into a BlackNevas ransomware case in an ESXi environment in October 2025 and a The Gentlemen ransomware case in a Proxmox environment in August 2026, Kaspersky experts concluded that the main attack path in these incidents came from misconfiguration and credential exposure, not from breaking the hypervisor boundary. Weak access controls, limited network separation, exposed administrative services and unsafe handling of privileged credentials gave attackers a practical route from supporting systems into the virtualization layer, where they were able to affect multiple hosts.
The monitoring gap. The experts investigated BlackNevas ransomware activity linked to a Windows system in a virtualized domain controller segment — a part of the IT environment responsible for managing user authentication and access. UserAssist artifacts, which can show what was launched on a Windows machine, indicated the execution of AnyDesk, a remote access tool, and a GMER binary, a program often used to inspect low-level system activity. The environment also used PRTG Network Monitor, an infrastructure monitoring platform, which had broad access to ESXi hosts — the servers running virtual machines.
Kaspersky experts found that the same root password, giving the highest level of administrative access, had been reused across several nodes. After compromising the monitoring environment, the attacker used those credentials to connect to ESXi hosts over SSH, a standard remote administration channel. From there, the attacker uploaded a file named esx and attempted to run it. The first attempt was blocked with the error message, “Execution of non-installed file prevented.” But because the attacker had root access, they were able to change the system settings and eventually run the malware. The activity also included log deletion intended to reduce forensic visibility and make the attack harder to investigate afterward.
Credentials in plain sight. A similar pattern was noted in a separate Proxmox case involving The Gentlemen ransomware. There, the attacker obtained administrative credentials and access details from notes stored on a compromised administrator workstation — an employee system used to manage core IT infrastructure. That information allowed the attacker to log in to Proxmox as root, the highest-privilege account, activate the VNC web socket, a browser-based remote console used to interact with virtual machines, and use that access to download and execute ransomware across the cluster — a group of connected servers managed together. The result was encryption of the virtual environment.
“These cases show that defenders need to treat monitoring platforms, administrator workstations and management networks as part of the virtualization attack surface,” said Rauf Johari, Kaspersky Global Emergency Response Team (GERT) expert. “They also show why patching alone is not enough. A fully patched hypervisor can still be compromised if an attacker can rely on a shared password, an overprivileged monitoring account, an open SSH path or an administrator interface reachable from a general server network. In the ESXi case, a built-in execution control initially worked as intended, but the attacker had enough privilege to disable it. For businesses, this means tightening administrative access, isolating management systems and reducing the exposure of privileged credentials should be a core part of protecting virtual infrastructure.”
To stay safe, Kaspersky recommend that organizations:
- Isolate virtualization management systems from the general server network.
Administrative interfaces, monitoring platforms and management networks should be segmented and accessible only from tightly controlled systems. - Eliminate the routine use and storage of shared or reusable privileged credentials.
Root and other high-privilege accounts should be strictly controlled, regularly rotated and never stored in plaintext or in easily accessible internal systems. - Limit administrative access to the minimum necessary. Apply least-privilege principles to monitoring accounts, administrator workstations and service access so that a compromise of one supporting system does not lead directly to hypervisor hosts.
- Harden and monitor the systems that can reach virtualization hosts. Monitoring servers, administrator endpoints and SSH paths should be treated as part of the attack surface, with stronger access controls, continuous monitoring and rapid detection of suspicious activity.
- Use a specialized security solution. Kaspersky Cloud Workload Security is perfectly suited to address virtual environment risks, offering a powerful combination of two products: Kaspersky Hybrid Cloud Security and Kaspersky Container Security.
- Use multi-layered security solutions such as Kaspersky Next which enables unified real-time protection, threat visibility, investigation and the response capabilities of EDR and XDR.
- Kaspersky Compromise Assessment, Managed Detection and Response and Incident Response help protect against evasive cyberattacks, investigate incidents and provide additional expertise if companies lack cybersecurity workers.
- Provide cybersecurity specialists with access to cyber threat intelligence, for example through Threat Intelligence services, so they can stay informed about the latest attacker techniques, tactics and procedures.
Read the full report on Securelist.com