Virtual machines (VMs) are everywhere. We use them to host file sharing, backups, network services, SSO, and more. Even with cloud computing now firmly established, on-prem virtual stacks remain common in many organizations, providing a convenient way to isolate different services that share hardware.
While the virtual machines themselves are often well looked after, the Field Effect team regularly observes far less concern for the hypervisors on which those VMs are built and run.
That gap hands threat actors easy access to (and an easy way to destroy) an organization's infrastructure.
The critical role of hypervisors
Hypervisors are specialized software that manage and allocate physical hardware resources between isolated virtual machines.
While "hosted" hypervisors (installed as an application on a full operating system) exist, most production VMs sit on bare-metal hypervisors. These are stripped-back operating systems installed directly on server hardware, dedicated solely to virtualization.
Those we most commonly see in client environments are:
- Hyper-V: native to Windows Server
- Proxmox: open source, built on Debian using the Linux-native KVM/QEMU stack
- VMware ESXi: built on VMware's proprietary VMkernel
Importantly, due to the nature of their role, a hypervisor has full access to the VMs, their storage, and any virtual (or physical) hardware assigned to them. This means a compromised hypervisor puts every critical component running on it, and every piece of data stored on it, at risk.
Common hypervisor attack patterns
Threats against hypervisors are often simpler than people expect. That simplicity, combined with how much critical infrastructure is hosted on them, has drawn ransomware groups and opportunistic actors to them as key targets.
Even if the VMs themselves are hardened, monitored, and running an endpoint detection and response (EDR) solution, they're still stored and managed on the hypervisor. If neglected, these well-defended VMs are handed to threat actors with few barriers in the way.
An attacker can encrypt, exfiltrate, or delete a VM's disk files (VMDK on ESXi, VHDX on Hyper-V), compromising an entire server's data without a single command running on the VMs themselves.
Recent examples
Microsoft has documented actors such as Storm-0506 and Octo Tempest exploiting CVE-2024-37085, where ESXi hosts integrated with Active Directory automatically grant full admin rights to any domain group named "ESX Admins." This means an attacker with a foothold in AD could simply create that group and walk in.
DragonForce and Scattered Spider reportedly used ESXi-focused payloads and credential abuse in their 2025 attacks on UK retailers, with damages for Marks & Spencer alone reportedly exceeding $400 million.
VMware reported five critical (CVSS 9.0+) vulnerabilities in its core virtualization products in 2024 and four in 2025. Several were remotely exploitable or allowing an attacker to escape a compromised guest VM and execute code on the underlying hypervisor.
The pattern continues into 2026. Broadcom's July patch round included two vCenter flaws scoring 9.8, an authentication bypass and a directory-traversal bug allowing arbitrary code execution, plus an ESXi VM-escape vulnerability in the VMXNET3 adapter, details we covered as they broke.
Plenty of lower-scored vulnerabilities were similarly dangerous. The previously mentioned CVE-2024-37085, for example, was only a CVSS 6.8, but affected all ESXi environments integrated with AD by default.
Most of what we see at Field Effect is simpler still:
-
Hypervisors with SSH or RDP open to the whole network
-
Management interfaces reachable from the internet
-
Virtual stacks with no segmentation at all
These easy-to-miss mistakes (or convenience-driven choices) mean even a low-sophistication attacker can quickly pivot to these exposed hypervisor targets.
And ransomware groups are exactly who's looking. Rather than breaking into machines one by one, an attacker can encrypt VM disk files from the host, or the host's storage itself, taking down every VM in one move.
We've recently observed organizations impacted this way, with Hyper-V servers specifically targeted for encryption. Because Hyper-V runs on Windows Server, many ransomware families already have the capability to impact the underlying host without needing any ESXi-specific tooling.
Common mitigations to harden hypervisors
None of this means hypervisors are indefensible. Most of the attack paths above rely on gaps that are well understood and straightforward to close.
The challenge is that hypervisors often sit outside the patching cycles, access reviews, and network segmentation applied to everything else, simply because they're treated as invisible infrastructure rather than a critical asset in their own right.
Treating the hypervisor layer with the same rigor as the VMs it hosts goes a long way toward shutting down the attack patterns described above.
Patch the hypervisor itself
Ensure both virtual machines and hypervisors are patched regularly, and that critical security patches are implemented as soon as possible.
Isolate management access
Put management interfaces on a dedicated, firewalled network or VLAN, never exposed to the internet, and unreachable from unnecessary devices.
Lock down identity
Named accounts, MFA, least privilege, regular access audits; limit which groups/users are granted admin rights and integrate with AD only when necessary.
Limit AD account access
Consider local non-domain accounts for management, and limit which domain accounts can reach the hypervisor. This hardens against lateral movement between the domain, hypervisor, and other hosts on your domain.
Reduce the attack surface
Disable unused services (such as SSH when not in use) and keep unnecessary ports closed.
Keep tested, isolated backups
Ensure backups are stored elsewhere (offline or immutable). Backups can’t be used as part of the recovery if they're stored on an encrypted hypervisor.
Ensure network services have redundancy
If the DNS server or a Domain Controller is set up on an attacked hypervisor, the lack of a separate, redundant server elsewhere can significantly drag out recovery time if that hypervisor is attacked.
A holistic approach to cybersecurity
The mitigations above will meaningfully reduce exposure, but hypervisor attacks succeed because something got missed: a port left open "temporarily," a domain account with more access than needed, or a patch that was scheduled but never applied.
Prevention is a moving target, and attackers only need you to slip once. Hypervisors sit at the center of your infrastructure, but are routinely left out of security monitoring and create blind spots in an otherwise well-defended network.
Closing that gap means locking things down and watching them 24x7, so anything that gets through is caught and contained before a single VM is impacted.
This is where we come in. Field Effect MDR monitors your endpoint, network and cloud layers in real time from a single platform, backed by a 24/7 SOC staffed by former intelligence operatives.
With support for monitoring Windows Hyper-V and VMWare ESXi environments, that holistic view extends to the virtual infrastructure that attackers increasingly target.
The result? The hypervisors at the center of your network are monitored and secured, just like the services running on top of them.
