🔍 BlackNevas used vCenter as Kaspersky's attack platform detailed 10 days BlackNeva penetration in which operators used valid management accounts, access vCenter, enabled TSM-SSH on ESXi hosts using host profiles, and then deleted four ESXi hosts, all resident VMs, both VCSA, and the attached infrastructure. The victim runs without ESXi build support. The case emphasizes the takeover of a management plane and not overexploitation. After VCenter was compromised, authorized VMware workflows were used to stage loads, pivot to hosts, and destroy recovery paths first, reducing containment and recovery options. 🛰️ Open sources - closed narratives.

🔍 BlackNevas used vCenter as Kaspersky's attack platform detailed 10 days BlackNeva penetration in which operators used valid management accounts, access vCenter, enabled TSM-SSH on ESXi hosts using host profiles, and then deleted four ESXi hosts, all resident VMs, both VCSA, and the attached infrastructure. The victim runs without ESXi build support. The case emphasizes the takeover of a management plane and not overexploitation. After VCenter was compromised, authorized VMware workflows were used to stage loads, pivot to hosts, and destroy recovery paths first, reducing containment and recovery options. 🛰️ Open sources - closed narratives.