Huntress Shares Practical Defenses Against Ransomware Targeting ESXi Hypervisors
Summary
Huntress reports a rise in hypervisor ransomware in its 2025 case data and offers ESXi defenses, including MFA, network segregation, runtime hardening, patching, immutable backups, and log monitoring.
Key points
- Huntress says hypervisors accounted for 25% of malicious encryption in its case data in the second half of 2025, up from 3% in the first half; it identifies Akira as the primary actor driving the trend.
- The article describes attackers using compromised internal credentials and Hyper-V management utilities to reach hypervisors, undermine VM security, and deploy ransomware at scale.
- Recommended access controls include MFA, dedicated or tightly limited accounts, least privilege, management-network segregation, and audited jump boxes.
- Runtime defenses include enabling VMkernel.Boot.execInstalledOnly, disabling unused services such as SSH, and using lockdown mode.
- Huntress advises tracking ESXi and vCenter patch levels, prioritizing vendor updates, restricting exposed services such as SLP, and keeping management interfaces off the public internet.
- Recovery guidance includes offline or offsite immutable backups, separate backup credentials, full VM image coverage, and regularly tested recovery drills.
- The article recommends forwarding ESXi logs to a SIEM and alerting on suspicious logins, service changes, configuration drift, datastore unmounts, and unusual management access or datastore activity.
Article Details
- Defense Focus
- Detect and prevent ransomware activity targeting ESXi and other hypervisors through access controls, runtime hardening, patching, monitoring, and recoverable backups.
- Detection Methods
- Forward ESXi logs to a SIEM and alert on new root logins, service enablement, VIB acceptance-level changes, and datastore unmounts.
- Monitor host configuration drift, including lockdown mode being disabled, SSH being enabled, or execInstalledOnly being turned off.
- Review management-network traffic for unusual source IPs, lateral-movement attempts, and large datastore I/O patterns consistent with VM encryption.
- Correlate hypervisor events with change-control records and internal context, including unusual login times followed by SSH enablement.
- Data Sources
- ESXi /var/log/auth.log
- ESXi /var/log/hostd.log
- ESXi /var/log/shell.log
- ESXi /var/log/vobd.log
- ESXi management-network traffic and source IPs
- Host configuration state and drift
- Datastore I/O activity
- Administrative change-control records
- Rule Types
- SIEM alerts for suspicious ESXi authentication, service, VIB acceptance-level, and datastore events
- Configuration-drift alerts for lockdown mode, SSH, and execInstalledOnly settings
- Network-anomaly detections for unusual management-interface access and lateral movement
- Behavioral detections for high-volume datastore I/O consistent with VM encryption
- Platforms
- ESXi
- vCenter
- SIEM
- Defensive Actions
- Use dedicated local ESXi accounts or tightly restricted, audited accounts; avoid general-purpose domain administrator accounts.
- Require MFA for host management interfaces and vCenter, use strong vaulted passwords, enforce least privilege, and restrict access to dedicated administrator devices.
- Isolate the management network and route administrative access through a monitored, audited jump box or bastion.
- Enable VMkernel.Boot.execInstalledOnly = TRUE, disable unnecessary services such as SSH and ESXi Shell, and enable lockdown mode.
- Maintain an ESXi and vCenter inventory, apply vendor security updates, disable or restrict unnecessary exposed services including SLP, and do not expose management interfaces directly to the internet.
- Keep three copies of backups on two media types with one offsite; use immutable repositories or snapshots isolated from centralized identity, and regularly test full VM recovery.
MITRE ATT&CK
T1021 · Remote ServicesAttackers are described as pivoting from inside the network to hypervisors using compromised internal authentication credentials and management interfaces.T1486 · Data Encrypted for ImpactRansomware operators deploy payloads through hypervisors to encrypt virtual machine volumes and VMDKs.T1543 · Create or Modify System ProcessThe article identifies enabling hypervisor services, including SSH, as suspicious activity to monitor.T1562.001 · Disable or Modify ToolsThe article reports misuse of Hyper-V management utilities to disable endpoint defenses on virtual machines.T1562.004 · Disable or Modify System FirewallThe article describes attackers disabling ESXi lockdown mode as a precursor to ransomware deployment.T1562.009 · Safe Mode BootThe article describes attackers changing VIB acceptance levels and turning off execInstalledOnly as suspicious host-hardening changes.T1562.010 · Downgrade AttackAttackers are reported to enable SSH on ESXi as a precursor to ransomware payload deployment.
CVE
People
Threat Actors
Products
ESXiHomeBlogHardening the Hypervisor: Practical Defenses Against Ransomware Targeting ESXiHyper-VWe’ve seen misuse of Hyper-V management utilities, to modify VM settings and undermine security features.Microsoft Active DirectoryAlso, using domain-joined accounts (e.g., Active Directory (AD) accounts) for ESXi increases lateral movement risk.VMware vCenter ServerEnforce MFA for host management interfaces and vCenter access to protect against credential theft.