Scattered Spider Hacks VMware ESXi via Help Desk Social Engineering

Scattered Spider, a notorious financially motivated threat group, has escalated its attacks by compromising VMware ESXi hypervisors across major U.S. companies using no software exploits, but rather highly targeted social engineering tactics, Google’s Threat Intelligence Group (GTIG) has warned.

The group’s targets span across retail, airline, transportation, and insurance sectors, and their attacks can unfold within just hours.

From Help Desk to Hypervisor: A 5-Stage Attack

GTIG researchers describe a five-phase attack chain executed with surgical precision:

1. Initial Access via Social Engineering
   Attackers impersonate company employees and call the IT help desk, requesting password resets for Active Directory accounts. Once inside the network, they begin reconnaissance.
2. Reconnaissance and Escalation
   The attackers scan internal documentation for administrator names and privileged access groups—especially those managing VMware vSphere and ESXi. They also look for privileged access management (PAM) solutions to expand control.
3. Privileged Access Takeover
   Armed with a high-value administrator’s name, they impersonate that user in follow-up help desk calls to gain privileged access. This allows full control of VMware vCenter Server Appliance (vCSA) and access to ESXi hypervisors.
4. Lateral Movement and Data Extraction
   After enabling SSH and resetting ESXi root credentials, they perform “disk-swap” attacks to extract sensitive data like the NTDS.dit Active Directory database:
   • Domain Controller VMs are shut down
   • Virtual disks are attached to attacker-controlled VMs
   • Data is copied, and disks are re-attached to the original VM
5. Backup Destruction and Ransomware Deployment
   With full access, the attackers wipe backups, snapshots, and repositories. Finally, they deploy ransomware binaries over SSH, encrypting all VM files stored on the datastore.

Scattered Spider attack chain
Source: Google

Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.

A Complete Takeover Without Exploits

Google emphasized that Scattered Spider does not use software vulnerabilities in these attacks. Instead, they rely entirely on social engineering and abuse of native tools to achieve full infrastructure control, including virtual machines, backup systems, and domain controllers.

“Even without exploiting software flaws, Scattered Spider gains an unprecedented level of control over virtualized environments,” GTIG noted.

This approach bypasses in-guest security controls, as the threat actor operates below the guest operating systems, directly from the hypervisor layer.

Why VMware ESXi is an Attractive Target

GTIG believes that one reason Scattered Spider and other ransomware actors are increasingly targeting VMware infrastructure is due to organizational blind spots:

• vSphere and ESXi are often misunderstood or mismanaged
• Security controls tend to focus on endpoints or guests, not the hypervisor
• Backup and PAM systems are frequently hosted on the same infrastructure they’re meant to secure

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]

Source: bleepingcomputer.com

Source Link