Ransomware attacks on ESXi and Proxmox exploited reused and exposed credentials
RANSOMWAREThe Gentlemenredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Kaspersky GERT investigated two ransomware cases affecting ESXi and Proxmox virtual environments, with no VM escape needed. In the first, a PRTG Network Monitor server held VMware credentials and a root password reused across several ESXi hosts, letting the attacker disable execInstalledOnly and run encryption and log-wiping binaries. In the second, The Gentlemen group found root credentials in plain-text notes on an administrator workstation and used them to take over Proxmox.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Do not reuse the same root password across several ESXi hosts.
- Limit monitoring accounts to the privileges and network paths their monitoring task needs.
- Keep administrator interfaces and SSH access off general server networks.
- Stop storing administrative credentials in plain-text notes on workstations.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Kaspersky Securelist
Who and what is in it
Threat actors