Navigating the Virtualization Battlefield: A Deep Dive into Hypervisor Attack Vectors
Austin Gadient
BSides NYC 2025 (0x05) · Day 1 · Tech - Red
This talk, presented by Austin Gadient, CTO and co-founder of Valley Cyber, provides a critical examination of the escalating threat landscape surrounding hypervisors, with a particular focus on VMware ESXi. Gadient highlights how these foundational technologies, which underpin modern cloud infrastructure and large enterprise environments, have become increasingly attractive targets for both ransomware groups and sophisticated nation-state actors. The presentation delves into various attack vectors, from exploiting decades-old vulnerabilities to leveraging advanced lateral movement techniques and bypassing native hardening mechanisms.
AI review
A competent, well-structured survey of ESXi attack surfaces with live demos that actually run — respectable for BSides NYC. The configstorecli Secure Boot bypass is the one moment of genuine depth; the rest is solid synthesis of known techniques (ESXir, Scattered Spider TTPs, AD integration abuse) that any ESXi-focused defender should know but probably already does if they've been paying attention since 2023.