BlackNevas Group Engages in Devastating 10-Day Attack on VMware ESXi Servers
In a grave incident highlighted by cybersecurity experts, the BlackNevas group executed a meticulously planned intrusion that resulted in the total destruction of an organization’s virtualization estate over a span of ten days. This alarming attack was investigated and documented by Kaspersky’s Global Emergency Response Team (GERT), revealing a series of sophisticated maneuvers that allowed the attackers to wreak havoc on critical IT infrastructure.
The Scope of the Attack
The BlackNevas group implemented a systematic assault, targeting four ESXi hosts—a core component of VMware’s virtualization technology. All virtual machines housed on these hosts were eradicated, along with both vCenter Server Appliances (VCSA) and the entire backup infrastructure connected to these systems. Notably, the attackers exhibited an advanced level of operational security, evading detection by manipulating legitimate VMware management interfaces, thus masquerading their intrusive activities as standard administrative functions.
Initial reconnaissance and movement allowed the attackers to gain access through valid accounts, relying on exploited credentials derived from non-virtualization systems situated within the organization’s perimeter. This approach, classified as MITRE ATT&CK T1078, underscored the importance of credential security within enterprise environments.
Exploiting Backup Infrastructure
One of the group’s predominant strategies involved extracting sensitive information from backup servers after establishing administrative-level access. The study emphasizes that backup platforms often harbor service accounts, hypervisor credentials, and pathways that facilitate lateral movement across tiers in the infrastructure.
The vulnerability in backup software such as a BinaryFormatter deserialization RCE flaw in Veeam Backup & Replication demonstrates the recurring security issues that jeopardize backup integrity and facilitate unauthorized access.
The operations commenced with a breach of the disaster-recovery vCenter, where the attackers seamlessly connected via SSH as the root user. Within an astonishingly short period of 43 seconds, they deployed MeshAgent, a component of the MeshCentral remote management suite. This established an additional channel for them to maintain persistence in the environment.
Approximately four hours elapsed before the attackers reentered via the MeshAgent interface to install a Ligolo-ng reverse tunnel. By employing a systemd unit named vmware-vdma.service, they created an architecture designed to avoid detection. The use of VMware-styled descriptors and a restart parameter aligned with other known tactics indicated a sophisticated understanding of VMware’s operations.
Unorthodox Techniques Employed
One of the most notable strategies leveraged by the attackers involved the manipulation of vCenter Host Profiles. They exploited compliance workflows to alter the status of TSM-SSH from disabled to operational. This shift allowed new SSH sessions to be initiated directly from the vCenter appliance to the ESXi hosts, bypassing traditional security controls.
Monitoring systems that only tracked interactive SSH sessions were rendered ineffective due to this unconventional technique. Security teams were advised to correlate entries from system logs such as vpxa.log and vobd.log to identify the sequence of events leading to the breach.
Days leading up to the devastating final act saw the perpetrators disable antivirus protections within the backup environment, halt backup services, and encrypt critical recovery repositories. This strategic ordering deprived the organization of the ability to restore systems before they initiated their primary attack against production environments.
Final Onslaught
When the moment for action arrived, the attackers executed their final command sequence: ./tmp/esx64 /p /vmfs/ /depth 5 /wipe /allsys /detach /-showvolumes. This meticulously crafted command led to the disabling of every virtual machine on the disaster-recovery host within an astonishing 23 seconds, according to the records from vmksummary.log. The malicious maneuver effectively overwrote the Master Boot Record (MBR) and primary GUID Partition Table (GPT) of each virtual disk, leading to considerable data loss.
Recommendations for Defenders
Cybersecurity experts urge organizations to treat vCenter as a Tier 0 asset, implementing stringent access controls, dedicated administrative identities, and phishing-resistant Multi-Factor Authentication (MFA). It is imperative that enterprises adopt a proactive stance, ensuring that operational layers like backup authority remain distinct from production Active Directories.
To enhance security, organizations should establish rigorous logging protocols to capture critical event logs and forward them to remote syslogs. Regular testing of recovery procedures, based on assumptions that vCenter and Active Directory may be compromised, is critically important.
Conclusion
The actions of the BlackNevas group serve as a stark reminder of the evolving threat landscape and the importance of vigilance in cybersecurity practices. The significant losses incurred in this incident reinforce the necessity of rigorous security protocols, especially regarding virtualization environments and backup integrity. Organizations must take heed of these lessons to bolster their defenses against such calculated and destructive assaults.