Hypervisor Ransomware: The Hidden Board-Level Attack Vector

Austin Gadient is CTO & cofounder of Vali Cyber . Vali’s product ZeroLock protects hypervisors and Linux systems from cyber attacks.

The hypervisor attack vector has historically been overlooked, and recent threats show it is a key risk to organizations. Hypervisor attacks are surging, with ransomware launched on VMware ESXi tripling between 2021 and 2022. Attacks are often costly, with some resulting in $400 million profit losses and long-term disruption .

Threat intelligence groups have recognized these trends, and recently, MITRE ATT&CK v17 added a matrix dedicated to ESXi . That recognition affirms what many of us who work close to the infrastructure layer have long observed: The control plane itself has become the battleground.

For some, the rise in hypervisor-focused attacks feels abrupt. For me, it’s the culmination of years spent designing and securing critical systems where a single layer’s failure could cascade through everything above it. Across both government and enterprise environments, I’ve seen how the hypervisor frequently falls outside the reach of traditional security controls. It’s rarely monitored with the same rigor as networks or endpoints, yet it governs them all.

The industry is only beginning to grasp what attackers already know: Control of the hypervisor is control of the enterprise. That’s why this layer is quickly becoming one of the most dangerous blind spots in modern cybersecurity.

Marks & Spencer was among the most visible examples. In April 2025, Scattered Spider affiliates reportedly deployed the DragonForce ransomware encryptor on the company’s VMware ESXi infrastructure, leading to widespread disruption and an estimated $402 million hit to annual operating profit.

MGM Resorts faced similar fallout in 2023 when its virtualization environment was compromised. Operations across gaming floors, hotel check-ins and digital services ground to a halt, costing over $100 million in remediation and lost revenue.

Johnson Controls faced similar turmoil after an ESXi-based breach disrupted building automation systems and led to a data leak that included Department of Homeland Security documents. Beyond the $27 million direct cost, the event triggered scrutiny from regulators and long-term damage to federal contract trust.

In the case of IxMetro Powerhost, attackers demanded a $140 million ransom after breaching its hypervisor layer, taking customer workloads down in the process.

The takeaway is clear: Hypervisor breaches aren’t “IT problems.” They’re governance issues that erase quarters of profit, can trigger SEC disclosure obligations and invite shareholder litigation.

Most enterprise defenses were built to monitor the layers above the hypervisor, not the infrastructure beneath them.

Firewalls still focus on north-south traffic flowing in and out of networks, missing the lateral movement that occurs between virtual hosts. Endpoint detection and response tools operate inside guest machines, leaving them blind to the hypervisor processes that manage those workloads. As a result, attackers who reach the virtualization layer can move undetected.

Add to that the persistence of unpatched hypervisors, default SSH credentials and insecure management consoles, and you have an environment that is both mission-critical and largely unprotected.

The shift to hypervisor-level targeting has elevated this issue from backend infrastructure risk to a material concern for executive and board oversight.

In today’s environment, boards can’t delegate this conversation to IT alone. Under the SEC’s 2023 cybersecurity disclosure rule , any incident that significantly disrupts operations or investor confidence can meet the threshold for materiality. Given that a hypervisor compromise can halt all workloads and revenue-generating systems, such an event would almost certainly qualify. That means executives have both a fiduciary and regulatory responsibility to understand how these environments are being secured.

To stay ahead of this growing threat, directors and executives should engage their security leadership with focused, outcome-driven questions. Continuous visibility into hypervisors is essential—if that layer can’t be monitored in real time, every workload above it runs on assumption rather than assurance.

They should also understand how many hosts still operate with outdated builds or default credentials, since a single unpatched console can expose the entire environment. Access controls warrant equal scrutiny: Multifactor authentication on management interfaces is often the only safeguard separating an administrator’s credentials from an attacker.

Detection is the measure of maturity. Leadership should know whether the organization can identify credential misuse or unauthorized administrative activity before workloads are impacted, and whether defenses align with MITRE’s ESXi framework to reflect real adversary behavior.

Together, these topics reveal technical readiness—and whether the enterprise truly governs the infrastructure its operations depend on.

Boards should ensure that hypervisor protection is built directly into the security roadmap and budget. Internal exposure reports should be reviewed regularly to confirm that hypervisors are patched, SSH access is restricted and backups remain uncompromised.

Service-level agreements for runtime protection must extend beyond endpoints and networks to include virtual environments. Detection and response programs should align with MITRE’s ESXi techniques so that coverage is auditable and defensible under compliance review.

Finally, tabletop exercises and incident simulations should test how the organization responds to a hypervisor compromise to validate that business continuity plans hold up when the foundation itself is attacked.

These risks go far beyond just the technical. They should have a place in your boardroom discussions as soon as possible.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?