Ransomware Gang Exploits SSH Tunnels for Stealthy VMware ESXi Access

Ransomware groups targeting VMware ESXi bare metal hypervisors are employing SSH tunneling techniques to infiltrate systems, establish persistence, and deploy their malicious payloads all while remaining under the radar. This sophisticated approach exposes critical gaps in monitoring and security practices across many organizations, emphasizing the need for improved defenses against these evolving threats. VMware ESXi appliances play a pivotal role in modern virtualized environments. These hypervisors enable businesses to run multiple virtual machines (VMs) on a single physical server, optimizing hardware usage and ensuring operational efficiency. However, their importance also makes them a high-value target for cybercriminals. By compromising an ESXi hypervisor, attackers can gain access to an organization’s entire virtualized infrastructure, steal sensitive data, and render critical systems inoperable through ransomware attacks.

Despite their significance, ESXi hypervisors are often inadequately monitored. Many organizations fail to implement robust logging and security measures, leaving these systems vulnerable to exploitation…