BlackNevas ransomware destroys ESXi virtualization estate via legitimate management interfaces
In a detailed investigation, Kaspersky’s Global Emergency Response Team analyzed a devastating ransomware campaign by the BlackNevas group that destroyed an organization's entire VMware ESXi virtualization infrastructure, including hosts, virtual machines, vCenter Server Appliances, and backup environments over ten days. Notably, the attackers did not exploit any ESXi hypervisor vulnerabilities; instead, they used legitimate VMware management interfaces and stolen administrative credentials to gain access and persist within the environment. The initial access vectors included credential reuse from compromised Windows systems and backup infrastructure abuse, with the adversaries establishing persistence via common management tools like MeshAgent and Ligolo-ng. The attackers manipulated vCenter Host Profiles to enable SSH on ESXi hosts, allowing direct remote access and subsequent deployment of ransomware payloads that partially overwrote virtual disk metadata, crippling recovery capabilities. The attack underscores the challenges in monitoring and securing virtualization layers, emphasizing the need to treat vCenter as a Tier 0 asset, restrict administrative accounts, isolate backup infrastructure, and implement comprehensive detection and logging strategies.
Linha do tempo
-
BlackNevas ransomware destroys ESXi virtualization estate via legitimate management interfaces
ler a análise desta fonte ocultar
In a detailed investigation, Kaspersky’s Global Emergency Response Team analyzed a devastating ransomware campaign by the BlackNevas group that destroyed an organization's entire VMware ESXi virtualization infrastructure, including hosts, virtual machines, vCenter Server Appliances, and backup environments over ten days. Notably, the attackers did not exploit any ESXi hypervisor vulnerabilities; instead, they used legitimate VMware management interfaces and stolen administrative credentials to gain access and persist within the environment. The initial access vectors included credential reuse from compromised Windows systems and backup infrastructure abuse, with the adversaries establishing persistence via common management tools like MeshAgent and Ligolo-ng. The attackers manipulated vCenter Host Profiles to enable SSH on ESXi hosts, allowing direct remote access and subsequent deployment of ransomware payloads that partially overwrote virtual disk metadata, crippling recovery capabilities. The attack underscores the challenges in monitoring and securing virtualization layers, emphasizing the need to treat vCenter as a Tier 0 asset, restrict administrative accounts, isolate backup infrastructure, and implement comprehensive detection and logging strategies.