{"id":"CMP-202611-yjdtwm","kind":"campaign","aliases":[],"related":[],"title":"BlackNevas ransomware gang reuses stolen logins to get into vCenter and ESXi, then encrypts and wipes every VM and the backups (Kaspersky)","description":null,"summary":"Kaspersky's Global Emergency Response Team describes a recent BlackNevas ransomware incident (BlackNevas has been active since November 2024; SentinelOne calls it a Trigona derivative). Over 10 days the attacker destroyed one unnamed organization's virtualization estate: four ESXi hosts with all their VMs, two vCenter Server Appliances and the connected backup infrastructure. No VMware vulnerability was used. The attacker logged into the normal VMware management interfaces with credentials stolen from other systems. They planted a Ligolo-ng tunnel on vCenter as a systemd service called 'vmware-vdma', turned on SSH (including through Host Profiles), uploaded the locker over SFTP to /tmp/esx64 and ran it with /allsys and /wipe. The victim's identity and the incident date are unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-13T09:41:47+00:00","products":[{"name":"VMware ESXi","fixed":[],"vendor":"Broadcom"},{"name":"VMware vCenter Server","fixed":[],"vendor":"Broadcom"},{"name":"Veeam Backup & Replication","fixed":[],"vendor":"Veeam"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"On vCenter (VCSA), look for a systemd unit named vmware-vdma under /etc/systemd/system that points to /opt/vmware/bin/agent (Ligolo-ng). On Windows, look for a service named vspbind (a remote-management agent). Search network logs for C2 domain api.cloudvflare[.]com and IP 45.149.154[.]135, and for management-portal logins from 91.92.242[.]121, 31.41.33[.]212 or 188.240.57[.]94. On ESXi, look for /tmp/esx64, '_wipe' markers on datastores, and SSH/ESXi Shell (TSM-SSH) being switched on unexpectedly, including through Host Profiles. File hashes: SHA-1 28f8da19ddcdf26e426875c7a834b34a79bc1c33 (svhost.exe / lock.exe); SHA-256 15dc419b7fbeb50c50820a7cd27997541deafa4fa710f074bb657f0149574baf and 5a9b7a0d3f25757aea957713d7e84cabec87597b3474368328a8fd5ed7a12f78 (remote-management agent).","fix":"Treat vCenter as Tier 0: give it dedicated admin accounts and phishing-resistant MFA, and put the management network behind access restrictions. Make sure domain admin accounts and broad AD groups do not get ESXi or vCenter rights (audit the group mappings; CVE-2024-37085 is fixed in ESXi 8.0 U3). Leave SSH and ESXi Shell off, use Lockdown Mode where you can, and alert on any change to TSM-SSH. Keep execInstalledOnly and the host acceptance levels at their secure settings. Send ESXi and vCenter logs to separate remote storage. Patch vCenter, ESXi and Veeam, and retire unsupported versions. Keep backups on separate identities, and test restoring them on the assumption that AD and vCenter are down.","status":"open","published_at":null,"first_seen_at":"2026-11-13T09:41:47+00:00","triaged_at":"2026-11-13T09:41:47+00:00","updated_at":"2026-11-13T09:43:18+00:00","category":"infrastructure","confidence":null,"triage":{"cause":{"at":"2026-11-13T09:46:04Z","path":"unknown","entry":"stolen-credential","reason":"The attacker \"logged into the normal VMware management interfaces with credentials stolen from other systems\", and the record does not say how the incident reached users, customers or dependents.","confidence":0.9}},"analyst_status":"done","analyst_note":null,"search":"'-202611':24A '/allsys':146B '/tmp/esx64':141B '/wipe':148B '10':64B '2024':56B 'activ':53B 'applianc':85B 'attack':67B,97B 'backup':21A,32A,89B 'blackneva':1A,47B,50B 'call':58B,124B 'campaign':34B 'cmp':23A 'connect':88B 'credenti':106B 'date':156B 'day':65B 'deriv':62B 'describ':44B 'destroy':68B 'earli':36B 'early-warn':35B 'emerg':41B 'encrypt':14A 'estat':74B 'esxi':12A,27A,76B 'everi':17A 'four':75B 'gang':3A 'get':8A 'global':40B 'host':77B,133B 'ident':152B 'incid':49B,155B 'includ':131B 'infrastructur':90B 'interfac':104B 'kasperski':22A,38B 'ligolo':115B 'ligolo-ng':114B 'locker':137B 'log':98B 'login':6A 'manag':103B 'ng':116B 'normal':101B 'novemb':55B 'one':69B 'organ':71B 'plant':112B 'profil':134B 'ran':143B 'ransomwar':2A,48B 'recent':46B 'replication':33A 'respons':42B 'reus':4A 'sentinelon':57B 'server':30A,84B 'servic':123B 'sftp':139B 'sinc':54B 'ssh':130B 'stolen':5A,107B 'system':110B 'systemd':122B 'team':43B 'trigona':61B 'tunnel':117B 'turn':128B 'two':82B 'unknown':158B 'unnam':70B 'upload':135B 'use':95B 'vcenter':10A,29A,83B,119B 'vdma':127B 'veeam':31A 'victim':150B 'virtual':73B 'vm':18A 'vms':81B 'vmware':26A,28A,92B,102B,126B 'vmware-vdma':125B 'vulner':93B 'warn':37B 'wipe':16A 'yjdtwm':25A","nicknames":["BlackNevas"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["backupreplication","blacknevas","esxi","vcenterserver","veeambackupreplication","vmwareesxi","vmwarevcenterserver"],"ptokens":["backup","esxi","replication","server","vcenter","veeam","vmware"],"labels":["campaign","earlywarning","high","infrastructure"],"campaign_type":"malware","search_a":"'-202611':24A 'backup':21A,32A 'blackneva':1A 'cmp':23A 'encrypt':14A 'esxi':12A,27A 'everi':17A 'gang':3A 'get':8A 'kasperski':22A 'login':6A 'ransomwar':2A 'replication':33A 'reus':4A 'server':30A 'stolen':5A 'vcenter':10A,29A 'veeam':31A 'vm':18A 'vmware':26A,28A 'wipe':16A 'yjdtwm':25A","search_b":"'/allsys':146B '/tmp/esx64':141B '/wipe':148B '10':64B '2024':56B 'activ':53B 'applianc':85B 'attack':67B,97B 'backup':89B 'blackneva':47B,50B 'call':58B,124B 'campaign':34B 'connect':88B 'credenti':106B 'date':156B 'day':65B 'deriv':62B 'describ':44B 'destroy':68B 'earli':36B 'early-warn':35B 'emerg':41B 'estat':74B 'esxi':76B 'four':75B 'global':40B 'host':77B,133B 'ident':152B 'incid':49B,155B 'includ':131B 'infrastructur':90B 'interfac':104B 'kasperski':38B 'ligolo':115B 'ligolo-ng':114B 'locker':137B 'log':98B 'manag':103B 'ng':116B 'normal':101B 'novemb':55B 'one':69B 'organ':71B 'plant':112B 'profil':134B 'ran':143B 'ransomwar':48B 'recent':46B 'respons':42B 'sentinelon':57B 'server':84B 'servic':123B 'sftp':139B 'sinc':54B 'ssh':130B 'stolen':107B 'system':110B 'systemd':122B 'team':43B 'trigona':61B 'tunnel':117B 'turn':128B 'two':82B 'unknown':158B 'unnam':70B 'upload':135B 'use':95B 'vcenter':83B,119B 'vdma':127B 'victim':150B 'virtual':73B 'vms':81B 'vmware':92B,102B,126B 'vmware-vdma':125B 'vulner':93B 'warn':37B","search_c":"","cause_entry":"stolen-credential","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-13T09:00:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-yjdtwm","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T09:41:47+00:00","fetched_at":"2026-11-13T09:41:47+00:00","note":null}],"documents":[{"id":144258,"url":"https://securelist.com/esxi-ransomware/121959/","title":"Kaspersky Securelist: Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes","kind":"blog","source":"blog","publisher":null,"text":"Ransomware at the hypervisor layer: how attackers use ESXi and vCenter features for malicious purposes\n\nKaspersky experts analyze a recent ransomware incident and discuss why the hypervisor layer remains difficult to monitor, what common access paths adversaries use to reach it, and how to protect your ESXi systems.","published_at":"2026-11-13T09:00:43+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}