Kaspersky GERT has investigated two ransomware incidents affecting ESXi and Proxmox environments. The Gentlemen group was identified as the threat actor responsible for the ransomware incident on Proxmox.
The investigation revealed that the incidents began with BlackNevas ransomware activity on a Windows system within a virtualized domain controller segment. UserAssist artifacts indicated the execution of AnyDesk RMM tool and GMER binaries.
In the ESXi environment, the threat actor gained root access, executing an encryption binary and performing anti-forensic log deletion. The PRTG deployment's broad access and reused root passwords across nodes facilitated the attack.
On the Proxmox environment, administrative credentials stored in plain text were discovered on a compromised system administrator workstation. The compromised root account was used to activate the VNC web socket, gaining extensive control over the Proxmox environment.
Weak access controls, insufficient network separation, exposed administrative services, and poor management of privileged credentials were identified as contributing factors to the incidents.