Virtualization security: attack layers and misconfiguration impact

Kaspersky GERT investigated two ransomware cases in ESXi and Proxmox environments in which weak access controls, insufficient network segmentation, exposed administrative services and poorly managed privileged credentials contributed to the impact. Attacks on virtual infrastructures rarely begin at the workload alone; hypervisors, container runtimes, management consoles, monitoring platforms, identity systems, virtual networks, datastores, backups and automation accounts all determine which resources an attacker can reach. In one of the cases a monitoring system was able to reach the virtualization layer and exposed a reusable root password. No specific CVE is named; the described compromises relied on misconfigurations, exposed administrative services and the reuse of privileged credentials.