Project
VMware's bare-metal hypervisor for running and managing virtual machines directly on server hardware, widely used in enterprise data centers.
Nutanix Move 6.3, shipped July 29, 2026, moves VMs from ESXi to AHV by repointing array metadata instead of copying vDisk data. Teams that drop the copy step also lose the validation checkpoint it used to force, and they still carry identity and dependency risk.
Reality
Gambit Security says the ransomware crew used a commercial coding agent for hands-on post-compromise work between 8 April and 21 May, alongside a new Linux encryptor that force-kills running guests before it touches ESXi datastores.
Perspective Coverage
4 publishersReality
CVE-2026-59310 gave a suspected APT crew persistence on vCenter systems in August. CISA has now flagged the same directory traversal as abused by ransomware operators. Broadcom patched it on July 29.
Reality
Kaspersky's responders found no encrypted files and no malware on disk across the Windows estate of a Middle East manufacturer in April 2026. The impact arrived through one Group Policy Object linked at the domain root.
Reality
GBHackers reports Aurora operators handing vulnerability analysis and payload delivery to Cursor agents against ESXi hypervisors, and Anthropic's September 2026 assessment describes the same delegation running for months inside state-linked campaigns.
Reality
The RaaS operation appeared on August 5 with build management for four operating systems, Tox-gated affiliate vetting and two Italian victims, and the encryptor those affiliates are uploading still awaits public analysis.
Reality
Guest memory statistics reach a Proxmox host over the virtio balloon device, so a VM set to balloon: 0 shows its whole allocation as consumed while Task Manager inside reports 30 to 50 percent. Enabling it need not cost you a fixed allocation.
Reality
Nine agencies across four countries refreshed the #StopRansomware Akira advisory on Nov. 13 with indicators current to November 2025 and a three-item action list.
Reality
Check Point Research says a nonce bug in every public VECT build leaves files above 131,072 bytes unrecoverable, by the attacker as well. That turns extortion into destruction.
Reality
Coveware says four bytes of the per-file public key get overwritten on the stack, so no private key exists for anything Nitrogen encrypted on ESXi. Not even the attacker can undo it.
Reality