Kaspersky GERT BlackNevas case: credentials from systems outside the virtualisation layer reach both vCenter appliances, a remote-access agent and a VMware-lookalike tunnel service persist, vCenter Host Profile remediation switches SSH on across the ESXi hosts, backups are destroyed first and a wipe of the datastores detonates over ten days, with no vulnerability exploited

Kaspersky GERT describes an engagement in which an adversary destroyed an organisation's virtualisation estate over ten days: four ESXi hosts, every virtual machine on them, both vCenter Server Appliances and all connected backup infrastructure (Kaspersky GERT, 2026-11-13). No virtualisation-layer vulnerability was exploited: credentials obtained from non-virtualisation systems inside the perimeter reached the appliances, and every action against ESXi ran through legitimate VMware management interfaces (Kaspersky GERT, 2026-11-13). The activity is attributed to BlackNevas through the ransom notes (Kaspersky GERT, 2026-11-13).

The attackers logged in as root over SSH to the vCenter appliance that manages virtualisation disaster recovery, fetched and deployed MeshAgent with a shell script 43 seconds later, and about four hours later returned through MeshAgent to install the Ligolo-ng tunnel as a persistent systemd unit whose name, description and Restart=always imitate appliance housekeeping (Kaspersky GERT, 2026-11-13). They then used vCenter Host Profiles to change the TSM-SSH service state: eleven minutes after the first configuration read SSH was enabled on the target ESXi hosts, and direct SSH to the hosts then came from the vCenter appliance address (Kaspersky GERT, 2026-11-13). Payloads went to ESXi over SFTP, a self-test of the executable ran about three hours before the final detonation, and about the first 2 KB of the virtual disk files were overwritten (Kaspersky GERT, 2026-11-13). The backup environment fell first: the attacker extracted stored credentials after gaining administrative execution on the backup infrastructure, disabled antivirus there days earlier, then stopped backup services and encrypted the recovery infrastructure, all before ESXi detonation (Kaspersky GERT, 2026-11-13).

Triage: each Host Profile step is legitimate alone, so the distinguishing context is authorisation, timing, source account, change window and whether the desired state weakens security; a VMware-looking service is not malicious by default, since custom integrations exist, but one absent from the trusted list is a high-confidence anomaly, and chmod +x is ambiguous alone while execution of a newly staged executable from /tmp is itself a strong indicator (Kaspersky GERT, 2026-11-13).