Hardening the Hypervisor: Practical Defenses Against Ransomware Targeting ESXi

Huntress warns of a significant rise in hypervisor-targeting ransomware in 2025—driven largely by the Akira group—where attackers exploit vulnerable ESXi/Hyper-V management interfaces or compromised credentials to encrypt multiple VMs at scale (CVE-2024-37085 is cited as a high-impact example). The advisory gives tactical guidance to reduce blast radius (local admin accounts, MFA, segregated management networks, jump boxes), harden runtime (signed VIBs, disable SSH, lockdown mode), prioritize patching, maintain immutable backups and recovery drills, and forward hypervisor logs to SIEMs for anomaly detection and faster incident response.