Research · 3 min read
Kaspersky: reused root passwords and monitoring access let ransomware hit ESXi and Proxmox
A new Securelist post walks through two real ransomware cases. Attackers did not need a VM escape: shared root credentials, an overpowered monitoring tool and plaintext admin notes were enough.
Kaspersky’s Global Emergency Response Team published a Securelist analysis on November 6, 2026 of two ransomware incidents in virtualized environments. The shared lesson is blunt: once an attacker has ordinary administrative reach to the hypervisor layer, every virtual machine on those hosts is at risk. No guest-to-host escape exploit was required.
Case 1: monitoring tool to ESXi encryption
Investigators found BlackNevas ransomware activity on a Windows system in a virtualized domain-controller segment, along with AnyDesk and GMER artifacts. The environment used PRTG Network Monitor against its ESXi hosts. That monitoring deployment held a reusable root password shared across several nodes.
After compromising the monitoring side, the attacker SSHed to the ESXi hosts with that shared root password, disabled the execInstalledOnly policy with esxcli, ran an encryption binary, and cleared logs. A first execution attempt was blocked by execInstalledOnly; the same root session then turned the control off. Password reuse turned one recovered secret into farm-wide access.
Case 2: plaintext notes to a full Proxmox cluster
In a separate incident attributed to The Gentlemen ransomware group, attackers who had already reached a system administrator’s workstation found Proxmox root credentials stored in plaintext notes. With root, they used the VNC websocket through the management API and encrypted the whole virtual environment. One weak credential-handling habit moved the intrusion from a single endpoint to every VM on the cluster.
What Kaspersky recommends
The researchers’ checklist matches the failures they saw:
- Give monitoring a dedicated, least-privilege identity. Do not store recoverable hypervisor root passwords on a general monitoring server.
- Prefer unique, vaulted credentials per host. Rotate after any suspected workstation compromise.
- Route day-to-day ESXi work through vCenter, keep SSH off by default, and alert when Lockdown Mode, Secure Boot or execInstalledOnly change.
- Keep management, backup and storage networks separate from general server networks.
- Forward logs to storage an attacker with host admin rights cannot wipe.
They also place these cases next to other virtualization risks (VM and container escapes, poisoned images, management-API abuse, flat virtual networks), but argue that closing the known administrative path should come first.
What this means if you run VMs at work or at home
If you administer ESXi, Proxmox or a similar stack, the research is a configuration audit prompt rather than a new CVE. Shared root passwords, monitoring tools that can open interactive admin sessions, and passwords in desktop notes are still common. Home lab setups often copy the same shortcuts at smaller scale.
What you can do
- Inventory where hypervisor and backup root passwords are stored, including monitoring tools, scripts and personal note apps.
- Replace shared root passwords and move routine admin through the central management plane with MFA where available.
- Confirm execInstalledOnly / equivalent controls are on and that changes raise an alert.
- Segment management networks so a breached app server cannot SSH to hypervisors.
- Keep offline or immutable backups that a live cluster admin account cannot delete.
How Frame helps
Frame focuses on personal exposure: breached accounts, data-broker listings and practical checklists. Frame can also look up your verified emails in Have I Been Pwned’s breach database. It does not harden hypervisors; use the Securelist guidance and your platform vendor’s lockdown docs for that.
Related coverage
- Queens Public Library ransomware disrupted branches’ digital services: a recent public-sector ransomware disruption.
- Attackers used a new OpenSSH flaw to get root on an Alpine honeypot within hours: another fresh reminder that remote admin paths are high value.
Sources
- Kaspersky Securelist, How misconfigurations in virtual environments can lead to compromise, November 6, 2026
More stories
- ResearchResearchers found 35,578 Grok-built apps that anyone could open, some with private data · 5 min read
- ResearchSymantec: AI helped attackers revive a stalled break-in at a US retailer · 5 min read
- MalwareKaspersky describes Citrus, a ransomware group that gets in through contractors and uses AI-written commands · 4 min read
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.