Threat video1:00
BlackNevas ESXi, The Gentlemen Proxmox: Detection & IOCs
Both cases skip software bugs, reusing ESXi root creds from PRTG and Proxmox admin notes. 9 detection rules, 16 IOCs and a free Splunk SPL rule.
Read the full threat intel for BlackNevas ESXi, The Gentlemen Proxmox: Detection & IOCs →
Chapters
- 0:00The hookTwo ransomware families attacked hypervisors directly.
- 0:04The storyPRTG credentials enabled direct SSH access.
- 0:12Attack pathDomain controller breach exposed monitoring tool credentials.
- 0:29AttributionAttributed to BlackNevas.
- 0:33Indicators of compromise8 indicators to hunt: 2 domains, 1 SHA-1 hash and 5 file names.
- 0:39MITRE ATT&CK techniques12 ATT&CK techniques, from initial access to impact.
- 0:44Remediation4 steps now: Rotate all hypervisor root credentials and remove plaintext credentials.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Two ransomware families attacked hypervisors directly.
0:05PRTG credentials enabled direct SSH access.
0:09Proxmox relied on admin workstation notes.
0:12Domain controller breach exposed monitoring tool credentials.
0:16SSH accessed ESXi directly as root.
0:19Ransomware uploaded over SSH, hosts destroyed.
0:23Proxmox admin workstation compromised, cluster encrypted.
0:29Attributed to BlackNevas. Confidence: medium.
0:338 indicators to hunt: 2 domains, 1 SHA-1 hash and 5 file names.
0:4012 ATT&CK techniques, from initial access to impact.
0:444 steps now: Rotate all hypervisor root credentials and remove plaintext credentials.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.