Guardians of the Hypervisor

The talk starts from why VMware vCenter and ESXi are attractive targets for ransomware. vCenter manages every host and virtual machine, and an ESXi host gives direct access to the datastores that hold virtual disks. The speakers, both from an incident response background, note that many intrusions are quiet rather than smash-and-grab, and that attackers like hypervisors because they are poorly monitored.

The middle section covers how intrusions typically happen. The most common route is through Active Directory accounts that hold administrative rights on vCenter. Other routes include passwords saved in browsers or text files, backup application credentials, and vulnerable virtual USB devices in guest machines. A live demo shows an attacker resetting the root password through vCenter and re-enabling SSH despite lockdown mode. The speakers then walk through ESXi ransomware samples, including one that shuts down virtual machines and encrypts VMDK files, and a leaked log showing an operator struggling with the platform's differences from Linux. They also test protective settings such as the exec-installed-only option and the VPX user shell-access restriction, and show how each can be bypassed.

The closing section focuses on defence. Default ESXi and vCenter logs are verbose, so the speakers suggest hunting for specific events such as root logins, configuration changes and ransomware-related messages. They recommend layering architecture, hardening, detection and response, and planning recovery with rebuildable hosts.