Scattered Spider Hijacks VMware ESXi to Deploy Ransomware on Critical U.S. Infrastructure

Jul 28, 2025Ravie LakshmananCyber Attack / Ransomware

The infamous cybercrime group known as Scattered Spider is focusing on VMware ESXi hypervisors in attacks aimed at retail, airline, and transportation sectors in North America.

According to an in-depth analysis by Google’s Mandiant team, the group’s primary strategies do not rely on software exploits but instead revolve around phone calls to an IT help desk.

Google stated that the attackers are adept at using social engineering to breach even well-established security systems, targeting an organization’s most critical systems and data with precision.

Also known as 0ktapus, Muddled Libra, Octo Tempest, and UNC3944, these threat actors have a history of leveraging advanced social engineering tactics to gain initial access to victim environments and then using a “living-off-the-land” approach to pivot to the VMware vSphere environment.

Google highlighted that the method used by the attackers, allowing data exfiltration and ransomware deployment directly from the hypervisor, is highly effective as it bypasses security measures and leaves minimal traces of compromise.

The attack unfolds in five distinct phases:

• Initial compromise, reconnaissance, and privilege escalation
• Pivoting to the virtual environment
• Enabling SSH connections on ESXi hosts
• Weaponizing the access
• Pushing custom ransomware binary via SSH access to ESXi hosts

Google emphasized the need for organizations to shift towards proactive, infrastructure-centric defense to counter such threats effectively.

According to Palo Alto Networks Unit 42, Scattered Spider actors have partnered with the DragonForce ransomware program and have successfully exfiltrated large amounts of data in a short period.

To mitigate such threats, organizations are advised to implement various protective measures, including enabling vSphere lockdown mode, enforcing multi-factor authentication, and centralizing and monitoring key logs.

As VMware vSphere 7 approaches end-of-life in October 2025, Google recommends organizations to re-architect their systems with security in mind to prevent ransomware attacks that can severely impact infrastructure and operations.

Google warns that ransomware attacks on vSphere infrastructure can lead to widespread infrastructure paralysis, emphasizing the importance of implementing recommended security measures to prevent operational disruptions and financial losses.