BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments

Key facts for BlackNevas ESXi and Proxmox ransomware

Detection coverage for BlackNevas ESXi and Proxmox ransomware

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5405 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BlackNevas ESXi Encryptor Execution, chmod Staging and Log Deletion - Post-Exploitation

Detects ESXi shell activity matching the BlackNevas 'esx' encryptor: './esx /log', 'esx /depth 5 /log /wipe', 'chmod a+x esx && chmod 777 esx', plus deletion of /var/log files after encryption (TL-2026-5405). Covers ingress tool staging, Unix shell execution, encryption/wipe and log clearing.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1105, T1486, T1485, T1070.002
• Data sources: esxi_shell_log, esxi_syslog
• Severity: critical
• Confidence: high

Splunk SPL

index=esxi sourcetype="vmw-syslog" ("esx /" OR "chmod" OR "/var/log/")
| regex _raw="(?i)(^|[\s;&|])(\./)?esx\s+/(log|wipe|depth|nohup|do_not_poweroff|chattr-i|detach|erase)\b|chmod\s+(a\+x|777)\s+esx\b|\brm\s+(-[a-z]+\s+)*/var/log/\S+"
| eval behaviour=case(match(_raw,"(?i)[ ;]rm "),"log_deletion",match(_raw,"(?i)chmod"),"permission_change",true(),"encryptor_execution")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(behaviour) as behaviours values(_raw) as commands by host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage matches regex @"(?i)(^|[\s;&|])(\./)?esx\s+/(log|wipe|depth|nohup|do_not_poweroff|chattr-i|detach|erase)\b|chmod\s+(a\+x|777)\s+esx\b|\brm\s+(-[a-z]+\s+)*/var/log/\S+"
| extend Behaviour = case(SyslogMessage matches regex @"(?i)\brm\s", "log_deletion", SyslogMessage has "chmod", "permission_change", "encryptor_execution")
| summarize EventCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Behaviours=make_set(Behaviour), Commands=make_set(SyslogMessage, 10) by Computer

Sigma

title: ESXi BlackNevas esx Encryptor Execution and Log Deletion
id: 8a4e6d12-0c3b-4f57-b1e9-72a5d9c4f602
status: experimental
description: Detects ESXi shell commands matching the BlackNevas esx encryptor (esx /log, esx /depth /wipe), chmod staging and log deletion (TL-2026-5405)
references:
    - https://securelist.com/virtualization-security-esxi-and-proxmox-ransomware-cases/121819/
    - https://www.sentinelone.com/anthology/blacknevas/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.execution
    - attack.t1059.004
    - attack.command_and_control
    - attack.t1105
    - attack.impact
    - attack.t1486
    - attack.t1485
    - attack.defense_evasion
    - attack.t1070.002
logsource:
    product: esxi
    service: shell
detection:
    selection_exec:
        - '*./esx /log*'
        - '*esx /depth *'
        - '*esx /wipe*'
        - '*esx /nohup*'
        - '*esx /do_not_poweroff*'
        - '*esx /chattr-i*'
    selection_chmod:
        - '*chmod a+x esx*'
        - '*chmod 777 esx*'
    selection_logdel:
        - '*rm -f /var/log/shell.log*'
        - '*rm -f /var/log/hostd.log*'
        - '*rm -f /var/log/auth.log*'
        - '*rm -f /var/log/vmkernel.log*'
        - '*rm -rf /var/log/*'
    condition: 1 of selection_*
falsepositives:
    - Administrators manually rotating or clearing ESXi logs during troubleshooting
    - Legitimate binaries named esx staged by in-house tooling
level: critical

Known false positives:

• Administrators manually clearing /var/log files during troubleshooting
• In-house automation that stages a binary literally named esx

Tuning notes: Exclude known automation accounts and change windows. Remote-forward ESXi logs off-box so attacker log deletion does not blind this rule. Add further encryptor switches (/erase, /detach, /chattr-i) as new samples are analysed.

• 🔒 AnyDesk and GMER Execution on Domain Controller - Exploitation Tooling · unlock with TL Creds
• 🔒 Mimikatz Credential Dumping and LSASS Access - Post-Exploitation · unlock with TL Creds
• 🔒 Connections to Community-Observed Cobalt Strike / BlackNevas Related Infrastructure - C2 · unlock with TL Creds
• 🔒 ESXi Direct Root SSH Login or SSH Service Enablement - Valid Accounts · unlock with TL Creds
• 🔒 PRTG Network Monitor Configuration File Access for Stored Hypervisor Credentials · unlock with TL Creds
• 🔒 GPO Modified to Add Scheduled Task Extension - Mass Deployment Staging · unlock with TL Creds
• 🔒 BlackNevas ESXi execInstalledOnly Disabled via esxcli - Exploitation · unlock with TL Creds
• 🔒 The Gentlemen Proxmox root@pam VNC Websocket Console Access - Lateral Movement · unlock with TL Creds

Indicators of compromise for BlackNevas ESXi and Proxmox ransomware

As of 2026-11-06, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5405.

Sample indicators (3 of 16)

• Domain: consultant[.]com
• File hash: 203f81cbe35c64071f52f34afbbbfc7d61b3e702
• Domain: newlookst[.]com

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

Community OSINT corroboration for BlackNevas ESXi and Proxmox ransomware

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How BlackNevas ESXi and Proxmox ransomware works

Kaspersky's Securelist article (published 2026-11-06) analyses two ransomware cases in which the hypervisor layer itself was attacked, and uses them to illustrate how misconfiguration and weak credential hygiene, not exploits, enabled mass encryption of virtual infrastructure. No CVE was exploited in either case; the CVEs mentioned in the article (VMware CVE-2025-22224, CVE-2026-31431 'Copy Fail', runc CVE-2024-21626, Portainer GHSA-7fw3-x4r2-g7wc, Docker CVE-2026-41567/41568/42306) are cited only as background on virtualization and container attack layers.

Case 1 - BlackNevas on ESXi. Responders found a compromised Windows domain controller (UserAssist artifacts showed execution of the AnyDesk remote-management tool and the GMER tool). The PRTG Network Monitor instance stored ESXi root credentials, and the same password was reused across multiple nodes. After gaining access to the monitoring platform the attacker used the stored credentials to authenticate over SSH directly to the ESXi hosts, bypassing vCenter role controls. SSH connection attempts began on 2025-10-18. On 2025-10-19 a malware binary named 'esx' was uploaded over SSH as root. Execution was first blocked by the ESXi execInstalledOnly policy; the attacker then disabled it with 'esxcli system settings advanced set -o /User/execInstalledOnly -i 0' and ran './esx /log'. A second host was handled the same way ('chmod a+x esx && chmod 777 esx', then the encryptor with '/depth 5 /log /wipe'). Logs were deleted after encryption. Affected hosts sat in 192.168.x.x and 172.16.x.x ranges.

Case 2 - The Gentlemen on Proxmox. A system administrator's workstation was compromised and privileged credentials and access details were found in plaintext notes. The attacker logged in as root@pam and used the Proxmox VNC websocket endpoint (GET /api2/json/nodes/<node>/vncwebsocket?port=5900&vncticket=...) to reach the consoles of multiple nodes between 2026-01-01 and 2026-01-08 (logged VNC websocket entries between 00:28:36 and 00:44:49). The ransomware was downloaded and executed inside the cluster and the entire virtual environment was encrypted.

Context from other sources: BlackNevas (aka Trial Recovery) is a Trigona-derived family first observed in November 2024 using AES-256 plus RSA-4112 and with ESXi-specific switches (/nohup, /do_not_poweroff, /chattr-i, /detach). The Gentlemen is a RaaS that emerged around mid-2025 with a Go locker for Windows/Linux/NAS/BSD and a C-based ESXi locker; Check Point (April 2026) observed Domain Admin-level operations, Cobalt Strike, Mimikatz, GPO-driven mass deployment and SystemBC proxy malware.

Securelist's defensive guidance: replace stored root passwords with vault retrieval or API tokens, give monitoring tools dedicated least-privilege identities, enable vCenter Lockdown Mode and keep ESXi Shell/SSH disabled, forward host/management/identity/firewall logs off-box, monitor execInstalledOnly, Secure Boot, Lockdown Mode, SSH state and firewall configuration, isolate management networks behind MFA jump hosts, and protect backups with separate identities and offline recovery copies. The article published no network IOCs or file hashes.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1552.001 Unsecured Credentials: Credentials In Files

Lateral Movement

T1021.004 Remote Services: SSH; T1021.005 Remote Services: VNC

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Initial Access

T1078 Valid Accounts

Command and Control

T1090 Proxy; T1219 Remote Access Tools

defense-impairment

T1484.001 Domain or Tenant Policy Modification: Group Policy Modification; T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs

Impact

T1485 Data Destruction

Remediation for BlackNevas ESXi and Proxmox ransomware

Patches

• No CVE patch applies to these cases; the intrusions abused credentials and configuration

Immediate actions

• Rotate all hypervisor root credentials and remove plaintext credentials from monitoring platforms (PRTG), scripts and administrator notes
• Disable ESXi SSH/Shell where not required and alert on any SSH enablement or direct root logins to hypervisors
• Alert on changes to the ESXi execInstalledOnly advanced setting and on root@pam VNC websocket sessions on Proxmox
• Forward ESXi, vCenter, Proxmox, identity, monitoring and firewall logs to remote storage

Workarounds

• Restrict management-plane access to jump hosts
• Continuously monitor execInstalledOnly, Lockdown Mode, SSH status and firewall rules for drift

Longer-term hardening

• Retrieve privileged credentials from a vault or use API tokens instead of stored root passwords
• Use dedicated least-privilege monitoring identities instead of root
• Enable vCenter Lockdown Mode, Secure Boot and TPM-backed enforcement on ESXi
• Isolate management networks behind MFA-protected jump hosts
• Protect backups with separate identities and recovery copies outside administrator reach

Affected and fixed versions

• VMware (Broadcom) — ESXi
  Vulnerable versions: Hosts with root SSH reachable, stored root credentials and execInstalledOnly disableable by root
• Proxmox Server Solutions — Proxmox VE
  Vulnerable versions: Clusters with root@pam credentials exposed in plaintext
• Paessler — PRTG Network Monitor
  Vulnerable versions: Instances storing hypervisor root credentials

Timeline of BlackNevas ESXi and Proxmox ransomware

• 2024-11-01 locked-ioc-10 (Trial Recovery), a Trigona-derived ransomware family, is first observed (November 2024, per SentinelOne).
• 2025-07-01 locked-ioc-6 RaaS emerges (around mid-2025) with a Go locker and a C-based ESXi locker.
• 2025-10-18 locked-ioc-10 operator begins SSH connection attempts to an ESXi host using ESXi root credentials harvested from PRTG Network Monitor.
• 2025-10-19 'locked-ioc-16' encryptor uploaded over SSH as root; execInstalledOnly disabled via esxcli; encryption run with './locked-ioc-16 /log' and later '/depth 5 /log /wipe' on a second host; logs deleted afterwards.
• 2025-12-01 locked-ioc-6 compromise Oltania Energy Complex (Romania) in December 2025, per reporting on the Check Point research.
• 2026-01-01 Attacker logs in as root@pam and begins VNC websocket sessions to Proxmox nodes using credentials from administrator notes (activity continues through 2026-01-08).
• 2026-01-08 Ransomware is downloaded and executed within the Proxmox cluster, encrypting the entire virtual environment.
• 2026-04-20 Check Point publishes research on locked-ioc-6 using locked-ioc-12 (over 1,570 infected hosts) with locked-ioc-5, locked-ioc-11 and GPO-based deployment.
• 2026-11-06 Securelist (Kaspersky) publishes the ESXi and Proxmox ransomware case analysis.

Sources cited for BlackNevas ESXi and Proxmox ransomware

• BlackNevas Ransomware: A Rising Global Cyber Threat (HivePro) hivepro.com · Advisory
• Virtualization security: attack layers and misconfiguration impact Kaspersky Securelist · Research · 2026-11-06
• BlackNevas Ransomware: In-Depth Analysis, Detection, and Mitigation (SentinelOne) SentinelOne · Vendor report
• Under the Hood: Deconstructing The Gentlemen ESXi Ransomware (Rubrik Zero Labs) zerolabs.rubrik.com · Research
• The Gentlemen Ransomware: Threat Intelligence Analysis (Red Piranha) redpiranha.net · Research
• A Closer Look at The Gentlemen's Alleged Leak (LevelBlue SpiderLabs) levelblue.com · Blog
• The Gentlemen ransomware now uses SystemBC for bot-powered attacks (BleepingComputer) BleepingComputer · News · 2026-04-20
• SystemBC C2 server reveals 1,570 victims (The Hacker News) The Hacker News · News

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services
• Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk