HighRansomware
Virtualization security: attack layers and misconfiguration impact
Securelist (Kaspersky)·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
Introduction Incidents in virtual environments can begin with a software vulnerability, human error, a configuration weakness, or several of these factors at once. The investigation is rarely limited to the workload. Hypervisors, container runtimes, management consoles, monitoring platforms, identity systems, virtual networks, datastores, backups, and automation accounts all influence what an attacker can reach.
Key details
- Kaspersky GERT investigated two ransomware incidents on ESXi and Proxmox where weak access controls and poor credential management led to broad compromise.
- In the Proxmox case, administrators stored root credentials in plain-text notes on a compromised workstation, enabling full cluster takeover.
- Both incidents show that a fully patched hypervisor can still be compromised through shared passwords, overprivileged monitoring accounts, or open administrative interfaces.
- NIST guidance treats secure configuration baselines, restricted administrative access, current patches, and cross-layer monitoring as a unified set of sound security practices.
Affected
- Proxmox environments where root credentials were stored in plain text on administrator workstations.
Fixes and mitigations
- Route ESXi administration through vCenter, enable Lockdown Mode, keep ESXi Shell and SSH stopped by default, and alert on service activation and root login.
- Enable execInstalledOnly with UEFI Secure Boot and TPM-backed configuration protection; monitor for changes to these settings.
- Store privileged credentials in an approved password manager or PAM system with MFA; rotate immediately if an admin workstation is compromised.
Summarised by SecOraLens from Securelist (Kaspersky). Always read the original source before acting. How SecOraLens verifies advisories.