Huntress

Ransomware Threats Targeting Hypervisors Surge

First seen 8 Dec 2025, 14:53 UTC • Forbes

+4 •56.7

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Hypervisor attacks, particularly on VMware ESXi, have increased significantly, with incidents tripling from 2021 to 2022. These attacks can lead to substantial financial losses, with some organizations facing up to $400 million in damages. The limited visibility and protections of hypervisors make them a critical vulnerability in modern virtualized environments.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

19 entities, 45 inferred relationships (STIX 2.1).

Threat Actor (4)

Scattered Spider
Akira
Akira ransomware group
DragonForce

Technique (1)

Ransomware

Organization (4)

IxMetro Powerhost
Johnson Controls
Marks & Spencer
MGM Resorts

Vulnerability (1)

CVE-2024-37085

Affected Platform (6)

Active Directory
ESXi
Hyper-V
Linux
Service Location Protocol
VMware ESXi

Tool (3)

Hyper-V Management Utilities
Openssl
SSH

Relationships

Scattered Spider uses Hyper-V Management Utilities
Scattered Spider uses Openssl
Scattered Spider uses SSH
Akira uses Hyper-V Management Utilities
Akira uses Openssl
Akira uses SSH
Akira ransomware group uses Hyper-V Management Utilities
Akira ransomware group uses Openssl
Akira ransomware group uses SSH
DragonForce uses Hyper-V Management Utilities
DragonForce uses Openssl
DragonForce uses SSH
Scattered Spider uses Ransomware
Akira uses Ransomware
Akira ransomware group uses Ransomware
DragonForce uses Ransomware
Scattered Spider exploits CVE-2024-37085
Akira exploits CVE-2024-37085
Akira ransomware group exploits CVE-2024-37085
DragonForce exploits CVE-2024-37085
Hyper-V Management Utilities exploits CVE-2024-37085
Openssl exploits CVE-2024-37085
SSH exploits CVE-2024-37085
CVE-2024-37085 targets Active Directory
CVE-2024-37085 targets ESXi
CVE-2024-37085 targets Hyper-V
CVE-2024-37085 targets Linux
Scattered Spider targets IxMetro Powerhost
Scattered Spider targets Johnson Controls
Scattered Spider targets Marks & Spencer
Scattered Spider targets MGM Resorts
Akira targets IxMetro Powerhost
Akira targets Johnson Controls
Akira targets Marks & Spencer
Akira targets MGM Resorts
Akira ransomware group targets IxMetro Powerhost
Akira ransomware group targets Johnson Controls
Akira ransomware group targets Marks & Spencer
Akira ransomware group targets MGM Resorts
DragonForce targets IxMetro Powerhost
DragonForce targets Johnson Controls
DragonForce targets Marks & Spencer
DragonForce targets MGM Resorts
Scattered Spider related to Service Location Protocol
Scattered Spider related to VMware ESXi

Continue Reading

Critical SonicWall SMA1000 Vulnerabilities Under Active Exploitation Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies Exploitation of Remote Services in Cyber Attacks CVE-2024-40766 Exploited by Ransomware Groups Targeting SonicWall Firewalls Ransomware Group Targets SonicWall Gen 7 Firewalls via CVE-2024-40766

Ransomware Threats Targeting Hypervisors Surge

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading