Kaspersky GERT: two ESXi and Proxmox ransomware cases in which a monitoring server's reused root password and plaintext administrator notes, not a VM escape, gave the attackers the hypervisor

In the first case, Kaspersky's investigation began with BlackNevas ransomware activity on a Windows system in a virtualised domain-controller segment, where the execution of the AnyDesk remote tool and the GMER binary was recorded (Kaspersky GERT, 2026-11-06). The environment used PRTG Network Monitor, whose deployment had broad access to the ESXi hosts, and the same root password was reused across several nodes; after obtaining access to the monitoring environment the attacker used the ESXi credential to connect over SSH to the hosts that shared the password (Kaspersky GERT, 2026-11-06). On the first host, a file was uploaded during a root SSH session and its first execution failed with "Execution of non-installed file prevented"; the actor then disabled the execInstalledOnly policy with esxcli and ran it, while on a second host in another subnet with the same password the binary ran and the logs were cleared (Kaspersky GERT, 2026-11-06).

In the second case, a ransomware incident by The Gentlemen, the actor used information it had collected between initial access and visible impact: on a compromised system administrator's workstation it found Proxmox root credentials and access details in plain-text notes and logged in as root (Kaspersky GERT, 2026-11-06). It then activated the VNC web socket through the root account, which gave it control of the Proxmox environment, and used that access to download and run the ransomware in the cluster, encrypting the whole virtual environment (Kaspersky GERT, 2026-11-06). Kaspersky says a fully patched hypervisor can still be compromised through a shared password, an overprivileged monitoring account, an open SSH path or an administrator interface reachable from a general server network (Kaspersky GERT, 2026-11-06).