Researchers at security software vendor Huntress are warning that hypervisors have become a rising target in ransomware operations, dramatically increasing the potential impact of a single breach across virtualised environments.

In a blog post on its site titled Hardening the Hypervisor: Practical Defenses Against Ransomware Targeting ESXi, Huntress says that “hypervisors are the backbone of modern virtualized environments, but when compromised, they can become a force multiplier for attackers. A single breach at this layer can put dozens or even hundreds of virtual machines at risk simultaneously.”

Unlike traditional endpoints, “hypervisors often operate with limited visibility and protections, meaning conventional security tools may be blind to an attack until it is too late.”

From its position in the SOC and threat-hunting arena, Huntress reports a significant rise in ransomware actors focusing on hypervisors throughout 2025.

Huntress case data revealed a surge in hypervisor ransomware: its role in malicious encryption rocketed from just 3% in the first half of the year to 25% so far in the second half. The primary actor driving this trend is the Akira ransomware group.

According to researchers, this shift demonstrates that the hypervisor layer now requires the same rigor applied to endpoints and servers.

Hypervisors: a new battleground

In the last few months of 2025, Huntress says that it has observed adversaries target hypervisors in an attempt to circumvent endpoint and network security controls.

As defenders continue to strengthen endpoint security, attackers are moving down the stack towards the foundation of virtualised infrastructure. The researchers note: “The shift is following a familiar playbook.”

Drawing parallels with attacks against VPN appliances, Huntress highlights the risk created where the host operating system is “proprietary or restricted, meaning defenders cannot install critical security controls like EDR. This creates a significant blind spot.” Type 1 hypervisors, installed directly on bare metal, present “the ultimate ‘land-and-expand’ target where traditional endpoint security often cannot reach”.

Huntress says it has already observed ransomware operators deploying payloads directly through the hypervisor, bypassing endpoint protections entirely. “In some instances, attackers leverage built-in tools such as openssl to perform encryption of the virtual machine volumes, avoiding the need to upload custom ransomware binaries.”

Once inside the corporate network, attackers often pivot towards hypervisors using compromised internal authentication credentials in environments where network segmentation has failed to deny lateral movement to the hypervisor management page.

With elevated privileges over the hypervisor, they can mount rapidly scalable ransomware deployment, “disabling endpoint defenses, tampering with virtual switches, and preparing VMs for ransomware deployment at scale”.

According to the researchers, this marks “a growing and uncomfortable trend: Attackers are targeting the infrastructure that controls all hosts, and with access to the hypervisor, adversaries dramatically amplify the impact of their intrusion.”

Improving access security and isolation

Huntress stresses that administrative access to hypervisors needs to be locked down to prevent environment-wide impact – if an attacker can obtain administrative credentials for the hypervisor, they can deploy ransomware payloads that affect every VM on the host.

Huntress warns that “using domain-joined accounts (e.g., Active Directory (AD) accounts) for ESXi increases lateral movement risk.”

Recommended mitigations include:

• Create dedicated, local ESXi accounts or strictly limited, audited domain accounts with only the necessary permissions.
• Enforce multi-factor authentication (MFA). 
• Use strong passwords stored in a secure password vault.
• Segregate the host management network.
• Deploy a jump box or bastion server.
• Apply the principle of least privilege(PoLP).
• Restrict management access to dedicated admin devices.

Huntress says these steps together “drastically reduce the potential attack surface”.

Locking down runtime execution

The researchers say that once an attacker reaches the hypervisor layer, they can “run code at the hypervisor level, bypassing guest-OS controls”. Hardening needs to ensure only trusted modules run.

They advise enabling the advanced setting “VMkernel.Boot.execInstalledOnly = TRUE so that only binaries installed via signed VIBs can execute,” and reducing operational exposure by disabling unused services such as SSH and locking down ESXi Shell access.

Patching and exposure reduction remain critical

Huntress warns that attackers are actively exploiting known hypervisor vulnerabilities as a means of mass-encryption. While the primary weaknesses remain segmentation lapses and exposed management interfaces, patch discipline remains essential.

“For example, CVE-2024-37085 highlights this hypervisor risk perfectly,” the report notes. The flaw could allow authorised AD users to automatically obtain “full administrative control of an ESXi host, leading to mass encryption of all VMs in seconds.”

Recommended reading

• Cybersecurity Workforce Growth Stalls, Skills Gap Widens
• ISC2 Survey: Women Comprise 22% of the Cybersecurity Workforce
• ISC2: Cybersecurity Workforce Growth Slows Despite AI Catalyst

Monitoring for anomalies and assuming breach

Because traditional EDR tools lack visibility at the hypervisor layer, organisations “need an alternative detection strategy”. The researchers say that “attackers often perform actions like changing the VIB acceptance level, enabling SSH, disabling lockdown mode, or creating new admin accounts, as precursors to ransomware payload deployment”.

They advise forwarding ESXi logs to SIEM, monitoring for configuration drifts, logging management-network traffic and adopting a “zero-trust mindset for hypervisor management”.

Huntress identifies several specific logs as “the most critical… for detecting and investigating hypervisor compromises”:
• /var/log/auth.log
• /var/log/hostd.log
• /var/log/shell.log
• /var/log/vobd.log

To avoid confusion between legitimate maintenance and threat activity, the researchers recommend a shared responsibility model when working with a third-party SOC or MDR. They write: “Your external security partner won’t have the necessary business context to distinguish routine internal maintenance from an adversary breaking in at 2 AM.”

Clear change-control procedures and communication are described as essential so the SOC can “focus their efforts where they are most effective”.

Huntress concludes with a warning that organisations should not assume hypervisor-layer prevention will always hold.

“Protecting bare-metal hypervisors like ESXi from ransomware requires a layered, proactive approach.” Even with rigorous controls, “organizations should also prepare for the possibility of a successful compromise.”