VMWARE ESXI · CMP-202611-yjdtwm · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kaspersky's Global Emergency Response Team describes a recent BlackNevas ransomware incident (BlackNevas has been active since November 2024; SentinelOne calls it a Trigona derivative). Over 10 days the attacker destroyed one unnamed organization's virtualization estate: four ESXi hosts with all their VMs, two vCenter Server Appliances and the connected backup infrastructure. No VMware vulnerability was used. The attacker logged into the normal VMware management interfaces with credentials stolen from other systems. They planted a Ligolo-ng tunnel on vCenter as a systemd service called 'vmware-vdma', turned on SSH (including through Host Profiles), uploaded the locker over SFTP to /tmp/esx64 and ran it with /allsys and /wipe. The victim's identity and the incident date are unknown.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
_wipe markers on datastores, and SSH/ESXi Shell (TSM-SSH) being switched on unexpectedly, including through Host ProfilesPosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.