Ghosts in the Hypervisor: Dissecting TTPs Behind Ransomware Attacks on Virtualization Infrastructure

Ghosts in the Hypervisor: Dissecting TTPs Behind Ransomware Attacks on Virtualization Infrastructure

Speakers: Austin Gaton, CTO and Co-Founder, Valley Cyber

Conference: BSides Seattle 2026

YouTube: https://www.youtube.com/watch?v=zWQ4zKaJp2I

Overview

Austin Gaton, CTO and co-founder of Valley Cyber (a Linux and hypervisor security company), delivers a technically dense talk on how attackers are targeting VMware ESXi hypervisors for both ransomware and espionage campaigns. Backed by multiple live demos, Gaton walks through the complete attack lifecycle: from the 2021 SLP heap overflow exploit (CVE widely exploited in 2023) through Scattered Spider's identity-based attacks on MGM Resorts ($100 million in damages), Active Directory privilege escalation via the ESX Admins group, the MITRE breach of May 2024, a novel technique to bypass VMware's exec-installed-only protection using Config Store CLI, and the Brickstorm nation-state espionage campaign's VMDK exfiltration techniques.

This talk matters because hypervisors are the foundation that everything else runs on -- cloud workloads, virtual machines, LLMs, containerized services. Huntress research documented a 700% increase in ransomware attacks against ESXi in recent years, and Google Mandiant's 2026 predictions explicitly called out infrastructure-centric attacks against virtualized environments. MITRE ATT&CK version 17 added VMware ESXi as a dedicated platform alongside Linux, Windows, and Mac, signaling the scale of the threat.

Background

▶ Watch: 700% increase in ESXi ransomware and Scattered Spider (2:00)

VMware dominates the private cloud hypervisor market, and Broadcom's acquisition has not reduced adoption -- revenue share has actually increased. This makes VMware ESXi the primary target for attackers, as they will invest effort where the largest installed base exists. While alternatives like Nutanix, Proxmox, and Microsoft Hyper-V exist, VMware's market dominance means attackers focus their tooling and TTPs on ESXi.

The traditional defense model for hypervisors relies on perimeter-based security: build a wall around the hypervisor and hope attackers don't breach it. This approach fails against identity-based attacks where adversaries steal system administrator credentials and use standard administrative protocols to access the environment. The hypervisor is typically a black box from the defender's perspective -- no EDR, no runtime monitoring, and no visibility into host-level activity.

Gaton's background includes the US Air Force Academy competitive hacking team (specializing in reverse engineering and binary exploitation), MIT graduate work on the DARPA HACS program (autonomously finding and destroying botnets through automatic exploit generation targeting Linux systems), and defensive Linux security work at Kirtland Air Force Base for satellite ground systems. Valley Cyber was founded specifically to address the Linux and hypervisor security gap.

Key Findings

▶ Watch: MGM Resorts breach: Scattered Spider playbook (14:00)

Persistent internet exposure: Despite the 2023 ESXi campaign exploiting CVE-2021-21974 against 19,000 publicly accessible systems, Shodan still shows approximately 20,000 VMware ESXi systems publicly accessible on the internet today, many running vulnerable versions. Some show ransom notes instead of the normal ESX web page, indicating active compromise.

Living off the land is the dominant attack pattern: Ransomware attacks on ESXi frequently use no downloaded malware. Attackers use native tools -- OpenSSL for encryption, grep for file enumeration, rm for deletion, and Netcat for reverse shells -- all installed on ESXi by default. This makes detection through traditional file-based scanning impossible.

Exec-installed-only bypass: Gaton demonstrates a novel bypass of VMware's exec-installed-only protection (which prevents running unsigned code) by using Config Store CLI directly instead of going through ESX CLI. The ESX CLI checks for secure boot before allowing acceptance level changes; Config Store CLI does not. By echoing a community-supported acceptance level into a JSON file and loading it via Config Store CLI, unsigned VIBs can be installed even with secure boot enabled. This was disclosed to VMware and is being patched.

Scattered Spider's playbook: The MGM Resorts breach ($100M in damages) followed a consistent pattern: SIM swap attacks against third-party IT help desks (now enhanced with AI voice cloning from YouTube videos), password reset social engineering, lateral movement through AWS to the VMware environment, SSH enablement on ESXi through vCenter, and living-off-the-land ransomware.

MITRE breach and VIB persistence: The May 2024 MITRE breach involved attackers installing malicious vSphere Installation Bundles (VIBs) for persistence. Because ESXi uses an in-memory filesystem that loses files on reboot, VIBs are the only way to make malware persistent. The acceptance level system (community, partner, certified) controls what VIBs can run, with partner-supported as the default requiring VMware-signed code.

Brickstorm espionage campaign: A nation-state attack reported by CISA and NSA that gained initial access through F5 Big-IP supply chain compromise (with a newer iteration using Dell appliances), then used stolen credentials to access vCenter and ESXi. Attackers deployed a Golang payload to clone VMDKs using VMKFStools, extract IMG files with statically compiled 7-zip, and search for secrets, credentials, and Active Directory data. Domain controllers were a primary target for credential harvesting.

Technical Deep Dive

▶ Watch: MITRE breach: VIB persistence and exec-installed-only bypass (22:00)

CVE-2021-21974 (SLP Exploit): A two-stage exploit against the SLP daemon on ESXi 6.7. Stage one: heap grooming through carefully crafted network requests to the SLP service, followed by an information leak to obtain libc base address, system address, and environ address, bypassing ASLR. Stage two: memory corruption using the leaked addresses to achieve arbitrary code execution in the SLP daemon's context, followed by sandbox escape. The GitHub PoC requires modifications to the heap grooming for reliability. The exploit ends with a reverse shell to an attacker-controlled Netcat listener.

Ransomware execution on ESXi: The critical first step is killing VMX processes. While a VM is running, the VMX process locks the VMDK file, preventing encryption. Attackers must first kill all VMs (using kill VMX), then either download dedicated ransomware (like the ESXArgs ransomware used in the 2023 campaign) or use living-off-the-land commands: grep to list VMDK files, openssl to create encrypted copies, and rm to delete originals.

Active Directory ESX Admins group attack (CVE-2024): A vulnerability where any user added to the "ESX admins" Active Directory group automatically gains administrative access to all ESXi hosts joined to that AD. No special credentials required beyond domain access. Mitigation: use a separate Active Directory instance for VMware management.

VIB installation and protection bypass: VIBs are tgz files with XML metadata defining file placement, permissions, and persistence. The exec-installed-only kernel protection prevents running unsigned code. Secure boot creates a trust chain for VIB signing verification. Gaton's bypass: configstorecli allows directly modifying the runtime configuration JSON to change the acceptance level to community-supported without the secure boot check that ESX CLI enforces. After loading the modified config, unsigned VIBs install successfully and malware runs even with exec-installed-only active.

VMDK forensics and exfiltration: VMDKs can be cloned while VMs run (using VMKFStools) to avoid detection. Cloned VMDKs are analyzed with 7-zip to extract IMG files, which can be searched with standard tools. For full exfiltration, VMDKs are mounted using QEMU as block devices, filesystems are identified and mounted, and all data becomes directly accessible. VMDK encryption helps against exfiltration but not against ransomware (attackers encrypt the already-encrypted VMDK).

VM Escape exploits: Two sets of escape-to-host vulnerabilities in 2025 (March Broadcom disclosure and Pwn2Own summer results). Huntress documented an exploit toolkit covering ESXi versions 5 through 8, with timestamps suggesting development over a year before patches were available. The payload file was named exploit.esxi.exe -- minimal obfuscation. The exploit used a malicious device driver in the guest to interact with the hypervisor via a vSock puppet, modifying the inetd configuration to establish command and control through the SSH daemon (inetd).

Rogue VMs: Virtual machines instantiated from the ESXi command line that do not appear in the vCenter UI. These provide persistence, stealth, and a launch point for lateral attacks into the network.

Demo / Proof of Concept

▶ Watch: Config Store CLI bypass of secure boot protections (28:00)

Gaton performed five live demonstrations:

1. SLP exploit and ESXArgs ransomware on ESXi 6.7 -- heap grooming, ASLR bypass via information leak, reverse shell, VMX kill, and VM encryption with the .args extension
2. Scattered Spider playbook -- SSH enablement through vCenter, living-off-the-land ransomware using OpenSSL/grep/rm against the Walter White VM
3. Active Directory ESX Admins exploitation -- adding a user to the group and gaining full ESXi access without any additional credentials
4. Config Store CLI bypass of exec-installed-only -- installing an unsigned community VIB on a system with secure boot enabled
5. Brickstorm VMDK exfiltration -- cloning VMDKs with VMKFStools, extracting IMG files, searching for secrets, and mounting full VMDKs with QEMU

Defensive Implications

▶ Watch: Defensive checklist: syslog, network segmentation, agent-based tools (40:00)

Gaton provides a comprehensive defensive checklist:

1. Network segmentation: Hypervisors must not be directly accessible from the internet or general network. Use jump hosts with MFA for administrative access. Guest VMs should be on separate network planes.
2. Patching and service hardening: Disable unnecessary services like SLP. Apply virtual patching through firewalls when immediate patching is impossible.
3. VMDK encryption: Protects against espionage/exfiltration (Brickstorm-style attacks) but does not prevent ransomware, since attackers can encrypt already-encrypted VMDKs.
4. Separate Active Directory: Do not join ESXi to the main corporate AD. Use a dedicated AD instance for VMware management to prevent domain-to-hypervisor lateral movement.
5. Syslog monitoring: Export syslog from vCenter and ESXi to SIEM/SOAR. Focus on security-relevant logs: vobd.log, shell.log, and hostd.log rather than all syslog data (which generates too much noise at scale).
6. Detect pre-ransomware behavior: Monitor for SSH enablement, acceptance level changes, exec-installed-only disabling, and VMX process kills -- these are the precursor steps before ransomware deploys.
7. Agent-based hypervisor protection: Emerging solutions that run on ESXi itself. Must be prevention-focused since the hypervisor is the last line of defense.
8. Shodan self-assessment: Use Shodan (free with account) to scan your own domain for publicly accessible VMware systems.

Key Takeaways

• Ransomware attacks on VMware ESXi have increased 700%, with approximately 20,000 systems still publicly accessible on Shodan despite the 2023 ESXArgs campaign
• Living-off-the-land attacks using native ESXi tools (OpenSSL, Netcat, grep, rm) are the dominant pattern, making file-based detection impossible
• MITRE ATT&CK v17 added ESXi as a dedicated platform, signaling the threat's maturity alongside Linux, Windows, and Mac
• A novel Config Store CLI bypass allows unsigned VIB installation even with secure boot and exec-installed-only protections enabled (disclosed to VMware)
• Scattered Spider's playbook (SIM swap to help desk, lateral movement to vCenter, SSH enablement, living-off-the-land ransomware) caused $100M in damages at MGM Resorts and continues to be replicated
• VMDK encryption protects against data exfiltration but not ransomware; separate Active Directory for VMware management prevents domain-to-hypervisor lateral movement

About the Speaker(s)

Austin Gaton is the CTO and co-founder of Valley Cyber, a Linux and hypervisor security company. He got his start at the US Air Force Academy on the competitive hacking team specializing in reverse engineering and binary exploitation. He completed graduate work at MIT on the DARPA HACS program focused on automatic exploit generation targeting Linux systems. He subsequently worked on satellite ground system security at Kirtland Air Force Base in Albuquerque, New Mexico. Valley Cyber was founded to address security gaps in Linux and hypervisor environments that he encountered with commercially available defensive tools.