BlackNevas Ransomware Destroys VMware Virtualisation Estate

Kaspersky’s Global Emergency Response Team (GERT) investigated a 10-day intrusion in which an attacker destroyed an organisation’s virtualisation estate: four ESXi hosts, their virtual machines, both vCenter Server Appliances and connected backup infrastructure. Ransom notes named the BlackNevas group, first observed in November 2024. GERT found no evidence that the attacker exploited an ESXi vulnerability or escaped from a guest system.

Instead, the attacker used legitimate VMware management interfaces, after obtaining credentials from non-virtualisation systems. Those credentials provided access to vCenter; administrative execution on backup infrastructure also enabled the attacker to extract stored credentials.

The attacker established persistence on a vCenter appliance using MeshAgent and a Ligolo-ng reverse tunnel installed as a systemd service. They then used vCenter Host Profiles to enable SSH on ESXi hosts, before connecting directly to them. GERT traced the activity through vCenter and host logs. The ransomware payload was uploaded to ESXi using SFTP; a `/selftest` run took about 16 seconds, roughly three hours before the destructive command.

Evidence indicated that about the first 2 KB of virtual-disk files was overwritten, but GERT cautioned that this alone does not establish whether partition metadata or data is unrecoverable. Before the final ESXi impact, the attacker disabled antivirus protection on the backup environment, stopped backup services, encrypted recovery infrastructure and disrupted administrative access.

GERT recommends treating vCenter as a highly privileged asset, separating virtualisation accounts from ordinary enterprise administration, and forwarding ESXi and vCenter logs to storage outside the virtualisation environment. Its response guidance includes preserving logs and configuration evidence before rebooting or making changes, as ESXi’s local logs may be lost at reboot.

The team also advises monitoring sequences such as unauthorised Host Profile changes followed by SSH access, new executables staged under `/tmp`, and rapid shutdowns of multiple virtual machines.