Researchers spot 700 percent increase in hypervisor ransomware attacks

Huntress reports a sharp increase in hypervisor-targeting ransomware—rising from 3% to 25% of malicious encryption activity in the latter half of the year—driven primarily by the Akira group; adversaries are exploiting weak hypervisor defenses to bypass endpoint protections, deploy encryption directly through hypervisors (including using built-in tools like OpenSSL), and misuse management utilities, prompting recommendations to enforce MFA, apply patches, use allow-listing, and monitor hypervisor logs.