Why Ransomware Operators Encrypt at the Hypervisor Instead of the Guest

When the CVE-2026-59310 campaign reached its final stage, the ransomware operator did not encrypt files inside individual virtual machines. It went underneath them, to the ESXiESXi🌐VMware's bare-metal hypervisor, installed directly on server hardware to run virtual machines. Each ESXi host is administered through vCenter, and its management interface controls the host's accounts, storage, and the workloads it runs, which makes that interface high-value attack surface. hosts, and encrypted the virtual disk files on the shared datastores directly. Dozens of workloads went dark from a handful of actions on a handful of hosts. This is not an accident of that particular intrusion. Attacking the hypervisorHypervisor🌐Software that creates and manages virtual machines by allocating physical hardware resources among multiple guest operating systems. VMware ESXi is a Type 1 (bare-metal) hypervisor. instead of the guest is a deliberate strategy, and understanding why reveals what your backup and recovery plans have to account for.

This article explains the economics of hypervisor-layer ransomware, why it is so efficient for the attacker, and what defenders should change in response.

One Host Holds Many Targets

A guest-by-guest attack scales linearly. To encrypt a hundred servers the old way, an attacker must land on a hundred systems, evade whatever endpoint protection each one runs, and encrypt each in turn. Every host is a fresh chance to be caught. The work grows with the number of targets, and so does the risk.

The hypervisor collapses that math. A single ESXi host may run dozens of virtual machines, and their disks are files, the .vmdk and .vmx objects, sitting on a datastore the host mounts. An attacker who controls the host does not need to enter any of the guests. It stops the running virtual machines, encrypts their disk files where they sit, and every workload on that host is gone at once. A hundred targets become a few hosts. The effort no longer scales with the number of victims, which is exactly the leverage an extortion operation wants.

The Guest's Defenses Do Not Apply

Everything you installed inside the virtual machines is bypassed. Endpoint detection agents, host firewalls, file-integrity monitoring, and in-guest logging all run within the operating system of the workload. When the attack happens at the storage layer beneath that operating system, none of those controls are in the path. The agent cannot flag an encryptionEncryption🛡️The process of converting data into a coded format that can only be read with the correct decryption key. process that is not running in its operating system. From inside the guest, the disk simply stops responding, because the host has stopped the machine and is rewriting its file.

This is why hypervisor ransomware feels so sudden. The layers you invested in for workload defense are looking in the wrong place. The relevant controls are the ones protecting the host and the management planeManagement Plane🌐The interfaces and services used to configure and administer a device, as distinct from the data plane that carries user traffic. On a remote-access appliance the management plane is the admin console; exposing it to the internet or to the user-facing portal is a common root cause of privileged compromise. that governs it, which is the same reason we argue that compromising vCenter hands over every VM it manages: the leverage lives below the guest, not inside it.

Speed and Sabotage

Hypervisor-layer encryption is also fast and hard to interrupt. In the observed campaign the operator's scripts stopped the virtual machines, ran the encryptor against the datastore, and removed the vSphere high-availability agent so the cluster could not automatically restart the workloads elsewhere. Disabling high availability is a telling detail: it shows the attacker understood the platform and deliberately removed the mechanism that would have masked or partially recovered the damage. The encryption may even serve double duty as anti-forensicsAnti-Forensics🛡️Techniques attackers use to hide or destroy evidence of intrusion, such as deleting or truncating log files, clearing event logs, or altering timestamps. Missing logs are themselves an indicator of compromise., destroying host logs along with the workloads.

The result is a compromise that is both wide and deep. Wide because a single action affects many workloads. Deep because the recovery features built into the virtualization platform have themselves been switched off.

Backups Are the Whole Game

If the attack encrypts at the hypervisor and disables in-platform recovery, then your defense against total loss is backups the attack cannot reach. That is a higher bar than most backup strategies meet. Snapshots stored on the same datastores are encrypted along with the workloads. Backup systems that authenticate to vCenter or ESXi can be reached by an attacker who forged administrator tokens, the credential exposure we describe in after a firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. breach, assume every stored credential is compromised. A backup an attacker with estate-wide administrator rights can delete or encrypt is not a backup for this scenario.

What survives is storage the compromised trust domain does not control: immutable backups that cannot be altered or deleted for a defined retention period, and copies kept offline or in an account with separate credentials. The test is simple to state and uncomfortable to answer honestly. If an attacker held administrator over your entire vSphere estate for a weekend, which copies of your data would still exist and be restorable? Anything reachable from that estate should be assumed gone.

Defend the Layer That Matters

Because the guest's defenses do not apply, the controls that count are the ones around the host and its management plane. Restrict who can reach the ESXi management interfaces and vCenter, force administrative access through controlled paths, and monitor for the precursors that this campaign showed: new local accounts on hosts, unexpected outbound connections from appliances, and changes to high-availability configuration. The build for that isolation is the subject of our guide on how to isolate a virtualization management plane from the rest of the network.

Hypervisor ransomware is efficient because virtualization is efficient. The same consolidation that lets one host run many workloads lets one compromise destroy them. You cannot un-consolidate, so the answer is to defend the host layer as the high-value target it is, and to keep at least one copy of everything that matters somewhere the hypervisor's authority cannot reach.