The BlackNevas group has been identified as the perpetrator behind a ransomware campaign targeting an organization's virtualization infrastructure over a ten-day period. The attack focused on four ESXi hosts, all virtual machines hosted on them, both vCenter Server Appliances, and connected backup infrastructure.
The attackers did not exploit any virtualization layer vulnerabilities. Instead, they executed their actions through legitimate VMware management interfaces. The targeted organization was running unsupported ESXi versions, which made them more susceptible to the attack.
The Babuk ransomware source code, leaked online in September 2021, has been utilized by at least ten subsequent ransomware families. This leak included the ESXi version, making it accessible to cybercriminals who previously lacked the expertise to develop ESXi-compatible ransomware.
Defenders are increasingly relying on built-in hardening, management-plane telemetry, and agentless security solution integrations for ESXi and vCenter.