Threat video1:00
BlackNevas ESXi Ransomware Hits vCenter: Detection & IOCs
BlackNevas wiped four ESXi hosts and two vCenters via valid logins and Host Profile SSH, with 9 detection rules, 15 IOCs and a free Splunk SPL rule.
Read the full threat intel for BlackNevas ESXi Ransomware Hits vCenter: Detection & IOCs →
Chapters
- 0:00The hookAbout 10 days to destroy ESXi.
- 0:04The storyHarvested logins reached vCenter.
- 0:10Attack pathReused credentials, then root SSH.
- 0:24AttributionAttributed to BlackNevas.
- 0:29Indicators of compromise11 indicators to hunt: 4 IPs, 1 domain and 2 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques12 ATT&CK techniques, from initial access to impact.
- 0:43Remediation6 steps now: Isolate vCenter from enterprise segments while keeping a controlled investigator.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 10 days to destroy ESXi.
0:05Harvested logins reached vCenter.
0:07Then four ESXi hosts were destroyed.
0:11Reused credentials, then root SSH.
0:14Hours later, MeshAgent returned with Ligolo-ng.
0:17Host Profile enabled SSH on ESXi.
0:20Then a wiper hit the hosts.
0:25Attributed to BlackNevas. Confidence: medium.
0:2911 indicators to hunt: 4 IPs, 1 domain and 2 SHA-256 hashes, and more.
0:3812 ATT&CK techniques, from initial access to impact.
0:436 steps now: Isolate vCenter from enterprise segments while keeping a controlled investigator.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.