# BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments

> Securelist (Kaspersky) documents two hypervisor ransomware incidents: BlackNevas on VMware ESXi (access via ESXi root credentials stored in PRTG Network Monitor) and The Gentlemen on Proxmox VE (access via plaintext credentials in an administrator workstation's notes). Both relied on credential reuse and direct management-plane access rather than a software vulnerability.

- **Published:** 2026-11-06T10:17:10Z
- **Last reviewed:** 2026-11-06T10:17:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5405
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5405.png
- **ID:** TL-2026-5405
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** BlackNevas
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

Kaspersky's Securelist article (published 2026-11-06) analyses two ransomware cases in which the hypervisor layer itself was attacked, and uses them to illustrate how misconfiguration and weak credential hygiene, not exploits, enabled mass encryption of virtual infrastructure. No CVE was exploited in either case; the CVEs mentioned in the article (VMware CVE-2025-22224, CVE-2026-31431 'Copy Fail', runc CVE-2024-21626, Portainer GHSA-7fw3-x4r2-g7wc, Docker CVE-2026-41567/41568/42306) are cited only as background on virtualization and container attack layers.

Case 1 - BlackNevas on ESXi. Responders found a compromised Windows domain controller (UserAssist artifacts showed execution of the AnyDesk remote-management tool and the GMER tool). The PRTG Network Monitor instance stored ESXi root credentials, and the same password was reused across multiple nodes. After gaining access to the monitoring platform the attacker used the stored credentials to authenticate over SSH directly to the ESXi hosts, bypassing vCenter role controls. SSH connection attempts began on 2025-10-18. On 2025-10-19 a malware binary named 'esx' was uploaded over SSH as root. Execution was first blocked by the ESXi execInstalledOnly policy; the attacker then disabled it with 'esxcli system settings advanced set -o /User/execInstalledOnly -i 0' and ran './esx /log'. A second host was handled the same way ('chmod a+x esx && chmod 777 esx', then the encryptor with '/depth 5 /log /wipe'). Logs were deleted after encryption. Affected hosts sat in 192.168.x.x and 172.16.x.x ranges.

Case 2 - The Gentlemen on Proxmox. A system administrator's workstation was compromised and privileged credentials and access details were found in plaintext notes. The attacker logged in as root@pam and used the Proxmox VNC websocket endpoint (GET /api2/json/nodes/<node>/vncwebsocket?port=5900&vncticket=...) to reach the consoles of multiple nodes between 2026-01-01 and 2026-01-08 (logged VNC websocket entries between 00:28:36 and 00:44:49). The ransomware was downloaded and executed inside the cluster and the entire virtual environment was encrypted.

Context from other sources: BlackNevas (aka Trial Recovery) is a Trigona-derived family first observed in November 2024 using AES-256 plus RSA-4112 and with ESXi-specific switches (/nohup, /do_not_poweroff, /chattr-i, /detach). The Gentlemen is a RaaS that emerged around mid-2025 with a Go locker for Windows/Linux/NAS/BSD and a C-based ESXi locker; Check Point (April 2026) observed Domain Admin-level operations, Cobalt Strike, Mimikatz, GPO-driven mass deployment and SystemBC proxy malware.

Securelist's defensive guidance: replace stored root passwords with vault retrieval or API tokens, give monitoring tools dedicated least-privilege identities, enable vCenter Lockdown Mode and keep ESXi Shell/SSH disabled, forward host/management/identity/firewall logs off-box, monitor execInstalledOnly, Secure Boot, Lockdown Mode, SSH state and firewall configuration, isolate management networks behind MFA jump hosts, and protect backups with separate identities and offline recovery copies. The article published no network IOCs or file hashes.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1552.001 Unsecured Credentials: Credentials In Files
- T1021.004 Remote Services: SSH
- T1021.005 Remote Services: VNC
- T1219 Remote Access Tools
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1685 Disable or Modify Tools
- T1685.006 Clear Linux or Mac System Logs
- T1485 Data Destruction
- T1003.001 OS Credential Dumping: LSASS Memory
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BlackNevas ESXi Encryptor Execution, chmod Staging and Log Deletion - Post-Exploitation** (`TL-2026-5405-SPL-002`)

Detects ESXi shell activity matching the BlackNevas 'esx' encryptor: './esx /log', 'esx /depth 5 /log /wipe', 'chmod a+x esx && chmod 777 esx', plus deletion of /var/log files after encryption (TL-2026-5405). Covers ingress tool staging, Unix shell execution, encryption/wipe and log clearing.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1105, T1486, T1485, T1070.002
- **Data sources:** esxi_shell_log, esxi_syslog
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=esxi sourcetype="vmw-syslog" ("esx /" OR "chmod" OR "/var/log/")
| regex _raw="(?i)(^|[\s;&|])(\./)?esx\s+/(log|wipe|depth|nohup|do_not_poweroff|chattr-i|detach|erase)\b|chmod\s+(a\+x|777)\s+esx\b|\brm\s+(-[a-z]+\s+)*/var/log/\S+"
| eval behaviour=case(match(_raw,"(?i)[ ;]rm "),"log_deletion",match(_raw,"(?i)chmod"),"permission_change",true(),"encryptor_execution")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(behaviour) as behaviours values(_raw) as commands by host
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage matches regex @"(?i)(^|[\s;&|])(\./)?esx\s+/(log|wipe|depth|nohup|do_not_poweroff|chattr-i|detach|erase)\b|chmod\s+(a\+x|777)\s+esx\b|\brm\s+(-[a-z]+\s+)*/var/log/\S+"
| extend Behaviour = case(SyslogMessage matches regex @"(?i)\brm\s", "log_deletion", SyslogMessage has "chmod", "permission_change", "encryptor_execution")
| summarize EventCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Behaviours=make_set(Behaviour), Commands=make_set(SyslogMessage, 10) by Computer
```

### Sigma

```yaml
title: ESXi BlackNevas esx Encryptor Execution and Log Deletion
id: 8a4e6d12-0c3b-4f57-b1e9-72a5d9c4f602
status: experimental
description: Detects ESXi shell commands matching the BlackNevas esx encryptor (esx /log, esx /depth /wipe), chmod staging and log deletion (TL-2026-5405)
references:
    - https://securelist.com/virtualization-security-esxi-and-proxmox-ransomware-cases/121819/
    - https://www.sentinelone.com/anthology/blacknevas/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.execution
    - attack.t1059.004
    - attack.command_and_control
    - attack.t1105
    - attack.impact
    - attack.t1486
    - attack.t1485
    - attack.defense_evasion
    - attack.t1070.002
logsource:
    product: esxi
    service: shell
detection:
    selection_exec:
        - '*./esx /log*'
        - '*esx /depth *'
        - '*esx /wipe*'
        - '*esx /nohup*'
        - '*esx /do_not_poweroff*'
        - '*esx /chattr-i*'
    selection_chmod:
        - '*chmod a+x esx*'
        - '*chmod 777 esx*'
    selection_logdel:
        - '*rm -f /var/log/shell.log*'
        - '*rm -f /var/log/hostd.log*'
        - '*rm -f /var/log/auth.log*'
        - '*rm -f /var/log/vmkernel.log*'
        - '*rm -rf /var/log/*'
    condition: 1 of selection_*
falsepositives:
    - Administrators manually rotating or clearing ESXi logs during troubleshooting
    - Legitimate binaries named esx staged by in-house tooling
level: critical

```

**Known false positives:**

- Administrators manually clearing /var/log files during troubleshooting
- In-house automation that stages a binary literally named esx

**Tuning notes:** Exclude known automation accounts and change windows. Remote-forward ESXi logs off-box so attacker log deletion does not blind this rule. Add further encryptor switches (/erase, /detach, /chattr-i) as new samples are analysed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AnyDesk and GMER Execution on Domain Controller - Exploitation Tooling (locked: unlock with TL Creds)
- Mimikatz Credential Dumping and LSASS Access - Post-Exploitation (locked: unlock with TL Creds)
- Connections to Community-Observed Cobalt Strike / BlackNevas Related Infrastructure - C2 (locked: unlock with TL Creds)
- ESXi Direct Root SSH Login or SSH Service Enablement - Valid Accounts (locked: unlock with TL Creds)
- PRTG Network Monitor Configuration File Access for Stored Hypervisor Credentials (locked: unlock with TL Creds)
- GPO Modified to Add Scheduled Task Extension - Mass Deployment Staging (locked: unlock with TL Creds)
- BlackNevas ESXi execInstalledOnly Disabled via esxcli - Exploitation (locked: unlock with TL Creds)
- The Gentlemen Proxmox root@pam VNC Websocket Console Access - Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- Domain: `consultant[.]com`
- File hash: `203f81cbe35c64071f52f34afbbbfc7d61b3e702`
- Domain: `newlookst[.]com`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Virtualization security: attack layers and misconfiguration impact](https://securelist.com/virtualization-security-esxi-and-proxmox-ransomware-cases/121819/)
- [BlackNevas Ransomware: In-Depth Analysis, Detection, and Mitigation (SentinelOne)](https://www.sentinelone.com/anthology/blacknevas/)
- [BlackNevas Ransomware: A Rising Global Cyber Threat (HivePro)](https://www.hivepro.com/threat-advisory/blacknevas-ransomware-a-rising-global-cyber-threat/)
- [The Gentlemen ransomware now uses SystemBC for bot-powered attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/the-gentlemen-ransomware-now-uses-systembc-for-bot-powered-attacks/)
- [SystemBC C2 server reveals 1,570 victims (The Hacker News)](https://thehackernews.com/2026/04/systembc-c2-server-reveals-1570-victims.html)
- [Under the Hood: Deconstructing The Gentlemen ESXi Ransomware (Rubrik Zero Labs)](https://zerolabs.rubrik.com/blog/under-hood-deconstructing-gentlemen-esxi-ransomware)
- [The Gentlemen Ransomware: Threat Intelligence Analysis (Red Piranha)](https://www.redpiranha.net/news/the-gentlemen-ransomware-analysis)
- [A Closer Look at The Gentlemen's Alleged Leak (LevelBlue SpiderLabs)](https://www.levelblue.com/blogs/spiderlabs-blog/a-closer-look-at-the-gentlemens-alleged-leak)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5405