Ransomware Targets ESXi Systems via Stealthy SSH Tunnels for C2 Operations
Jan 28, 2025
Ransomware / Threat Intelligence
Cybersecurity researchers have found that ransomware attacks targeting ESXi systems are also leveraging the access to repurpose the appliances as a conduit to tunnel traffic to command-and-control (C2) infrastructure and stay under the radar. "ESXi appliances, which are unmonitored, are increasingly exploited as a persistence mechanism and gateway to access corporate networks widely," Sygnia researchers Aaron (Zhongyuan) Hau and Ren Jie Yow said in a report published last week. "Threat actors use these platforms by adopting 'living-off-the-land' techniques and using native tools like SSH to establish a SOCKS tunnel between their C2 servers and the compromised environment." In doing so, the idea is to blend into legitimate traffic and establish long-term persistence on the compromised network with little-to-no detection by security controls. The cybersecurity company said in many of its incident response engagements, ESXi systems were compromised eit...
