24/7 ransomware incident response - Dubai & United Arab Emirates +971 52 758 9336
Virtualisation

Ransomware against VMware ESXi and Hyper-V

One host, forty virtual machines, one command. Hypervisors are the most efficient target an attacker can choose, and the most rewarding one for laboratory reconstruction.

A-Lab briefing · 7 minute read · For infrastructure teams and data-center operators

Why hypervisors first

Encrypting a hundred Windows servers means a hundred deployments, a hundred chances of being blocked by endpoint protection and hours of noise. Encrypting the three ESXi hosts they run on means three logins, no antivirus, and every server offline in minutes. Qilin, Akira, Medusa, Play, LockBit, INC and DragonForce all ship dedicated Linux encryptors for exactly this purpose. Since 2023 the majority of large enterprise incidents we see involve the hypervisor layer.

How an ESXi attack works

  1. The attacker obtains vCenter or ESXi credentials, usually from the same domain-administrator compromise that gave them everything else, or through an unpatched vulnerability in the management interface.
  2. SSH is enabled on the hosts. A small Linux binary is copied over.
  3. Running virtual machines are forcibly powered off with esxcli or vim-cmd so that their disk files are unlocked.
  4. The encryptor walks the datastores and encrypts .vmdk, -flat.vmdk, .vmx, .vmsn and .vswp files. Because virtual disks are large, only parts of each file are encrypted: typically a header region plus periodic blocks.
  5. A ransom note replaces the host login banner and appears in every datastore folder.

Hyper-V attacks follow the same logic on Windows: the VMs are stopped, the .vhdx and .avhdx checkpoint files are encrypted, and the cluster shared volumes become unusable.

Why reconstruction works

A virtual disk is a container holding a complete file system. When the container's header and a fraction of its blocks are encrypted, the file system inside is damaged the way a physical disk with bad sectors is damaged: partially. The laboratory approach is the same as physical . We image the datastore, rebuild the virtual disk geometry, map which blocks are encrypted, and recover the guest file system around them. Databases inside the VM are then repaired at page level. Where the family's encryption has a weakness, the encrypted blocks themselves are decrypted and the machine is returned bootable.

The VMFS layer matters. ESXi datastores use VMFS, a file system that laboratory tools can parse directly. Deleted or overwritten descriptor files, snapshot chains and thin-provisioned disks can frequently be reconstructed from the raw datastore even when the attacker deleted them.

What to do on the day

  • Do not reinstall ESXi or recreate datastores. Image the storage first.
  • Do not reformat the SAN LUNs or NAS volumes behind the datastores.
  • Keep the encrypted .vmdk and .vhdx files in place.
  • Send us the ransom note, a datastore listing and the first 50 MB of one encrypted virtual disk.

Reducing the next incident

Separate management networks for hypervisors, no direct domain trust for vCenter administrators, SSH disabled by default, immutable or off-site backup copies and prompt patching of management interfaces stop most of the attacks described above. A-Lab includes an entry-point report with every recovery so the same door is not left open.