Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes
Our Global Emergency Response Team (GERT) recently investigated an engagement in which an adversary destroyed an organization’s virtualization estate over a 10-day period. The campaign targeted four ESXi hosts, every virtual machine hosted on them, both vCenter Server Appliances, and all connected backup infrastructure. The ransom notes identified the attacker as the BlackNevas group, first observed in November 2024. What’s interesting about this attack is that no virtualization layer…
KEV ✓ · ransomware EPSS 1.00 CVE-2021-21972 CVE-2021-21974 CVE-2021-21985 CVE-2021-22005 CVE-2023-34048 CVE-2024-37085 CVE-2024-38812 CVE-2025-22224 CVE-2025-22225 VMware RU