Ransomware attacks on ESXi and Proxmox exploited reused and exposed credentials
- Severity
- High
- Sources
- 1
What happened
Kaspersky GERT reports two ransomware cases on ESXi and Proxmox that required no VM escape. In case one, BlackNevas activity followed a PRTG Network Monitor server holding stored VMware credentials and a root password reused across ESXi hosts; the actor used esxcli to disable execInstalledOnly and deleted logs. In case two, The Gentlemen used root Proxmox credentials from plain-text notes on an admin workstation and activated the VNC web socket. The article gives no CVE IDs or affected versions. Defenders should eliminate root password reuse, scope monitoring accounts to their task and network path, restrict admin interfaces and SSH, and remove credentials from notes and workstations.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Do not reuse the same root password across several ESXi hosts.
- Limit monitoring accounts to the privileges and network paths their monitoring task needs.
- Keep administrator interfaces and SSH access off general server networks.
- Stop storing administrative credentials in plain-text notes on workstations.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors