Protecting Hyper-V and VMware Hosts From Being Encrypted

Encrypting a hundred workstations takes an attacker hours. Encrypting the hypervisor takes minutes and gets every server at once, including the backup server if it is a VM. Ransomware groups know this, and several now ship encryptors built specifically for ESXi and for Hyper-V's VHDX files.

The host is one layer below everything you protect. It needs its own protection, separate from the VMs, and most of it comes down to who can reach the management interface and with what credentials.

How hosts get hit

The path is usually the same. The attacker gets Domain Admin through a workstation. If the hypervisor is domain joined, or if vCenter uses Active Directory for login, that credential opens the host. If not, they find the host password in a document, a password manager export, or a script on the file server. Then they SSH to ESXi or RDP to the Hyper-V host, stop the VMs, and run the encryptor against the datastore.

The second path is the management interface itself. ESXi and vCenter have had critical vulnerabilities, and hosts with management reachable from the user network, or worse from the internet, are exploited without any password.

Domain-joined hosts and vCenter with AD authentication turn a domain compromise into a hypervisor compromise automatically.
SSH enabled on ESXi and left on is the tool the encryptor uses.
Management on the same VLAN as workstations means every phished laptop can reach the login page.

Isolate the management plane

The single most effective control is a management network that user devices cannot reach. Put the host management interfaces, vCenter, iDRAC and iLO, the storage array and the backup server on a dedicated VLAN. Allow access only from a jump host or an admin workstation, and only for named admin accounts with MFA.

This does not affect the VMs. Their traffic stays on the production VLANs. Only the host's own management IP moves.

Create a management VLAN and move the ESXi VMkernel management port or the Hyper-V host's management NIC into it.
Firewall rule: allow HTTPS, SSH and RDP to the management VLAN only from the admin VLAN or jump host. Deny from Users, Guest, OT and the internet.
Put iDRAC, iLO and the storage controller on the same VLAN. They are hosts too.
Use a jump host with MFA (Remote Desktop Gateway with the NPS extension, or a privileged access tool) as the only way in.

Harden ESXi and vCenter

VMware publishes a security configuration guide with a long list. These are the items that matter most against ransomware, and all of them are settings rather than products.

Do not join ESXi hosts to Active Directory. Use local accounts with unique, long passwords stored in a password manager, or configure vCenter with a separate identity source and MFA.
Disable SSH and the ESXi Shell when not in use: Host > Configure > Services, set both to Stopped with startup policy Start and stop manually. Enable them for a task, then stop them.
Enable Lockdown Mode (Normal) so the host can only be managed through vCenter, not directly.
Enable execInstalledOnly so only signed VIBs can run: esxcli system settings kernel set -s execInstalledOnly -v TRUE, and enable Secure Boot on the host.
Keep ESXi on a supported version and patch on the emergency clock when VMware publishes a critical advisory. Check the build against VMware's advisory list.

# ESXi: check and set the key hardening switches
esxcli system settings kernel list -o execInstalledOnly
esxcli system settings kernel set -s execInstalledOnly -v TRUE
vim-cmd hostsvc/enable_ssh   # only when needed
vim-cmd hostsvc/disable_ssh
esxcli system version get

Harden Hyper-V

A Hyper-V host is a Windows Server, and it inherits both the good and bad of that. It gets patched with the monthly cycle, runs EDR, and has Windows Firewall. It is also domain joined by default and reachable by RDP from anywhere Windows admins go.

Treat the host as Tier 0 in the tiering model. Only Tier 0 accounts log in, only from the admin workstation, and the host is never used for browsing, email or as a place to run tools.

Run Server Core. No desktop means a smaller attack surface and fewer reasons for someone to RDP in.
Manage with Windows Admin Center or Hyper-V Manager from the admin workstation, not by logging into the host.
Restrict RDP and WinRM to the management VLAN with Windows Firewall rules on the host itself, so the rule holds even if the network firewall is misconfigured.
Install EDR on the host and exclude only the VHDX paths and the vmms and vmwp processes per the vendor's documented list.
Put Hyper-V hosts in their own OU with a Group Policy that denies logon to everyone except the Tier 0 admin group, and enable Credential Guard.

# Hyper-V host: restrict RDP to the management VLAN at the host firewall
New-NetFirewallRule -DisplayName 'RDP from mgmt VLAN only' -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 10.10.99.0/24 -Action Allow
Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -Enabled False

Frequently asked questions

Our backup server is a VM. Is that a problem?

It is if its repository is on the same datastore and the host can be reached by the same credential. Move the repository to separate storage the host cannot write to, or better, run the backup server on a separate physical box outside the domain with the immutable copy in object storage.

Can we still use Active Directory for vCenter login?

You can, but it means Domain Admin equals vCenter admin. If you keep it, use a separate AD group with only named admin accounts, enforce MFA through an identity provider federation, and keep at least one local vCenter account for break-glass in a safe.

Where do we start if we have one host and one IT person?

Management VLAN and firewall rule first, SSH off and Lockdown Mode second, local accounts with a long password third. That is an afternoon. RackLedge does host hardening reviews for both platforms if you want it checked.

Takeaway

The hypervisor is the highest-value target on the network and usually the least protected. Move its management to a VLAN users cannot reach, break the link between Domain Admin and host admin, turn off SSH, and keep backups on storage the host cannot write to. That turns a host compromise from a total loss into a contained one.