Imagine arriving at work to find that a single overnight breach has taken your entire virtual infrastructure offline. We aren't talking about one isolated server or a standalone application; we mean every single server and app across your business. What sounds like a disaster-movie scenario is the operational reality of a hypervisor ransomware attack. 

A group calling itself The Gentlemen has made it their business model. Emerging in early 2025, this threat actor has rapidly built a reputation for targeting VMware ESXi hypervisors, the foundational layer that runs virtual machines across enterprise data centers. Their operations are patient, methodical, and specifically engineered to disable your defenses and backups before detonating encryption across your entire environment.

Understanding how they operate is the first step toward surviving them.

“Compromising a single ESXi hypervisor can disable dozens of virtual machines at once. Ransomware operators know this. Your security strategy should too.”

Why Hypervisors Became The Prize Target

Ransomware was formerly an endpoint problem, a phished laptop here, a compromised workstation there. Today’s operators are playing a fundamentally different game, targeting infrastructure layers where a single successful strike can produce maximum organizational disruption with minimal technical effort.

ESXi hypervisors sit at the center of this calculus. A hypervisor is not just another server; it is the platform that runs all the servers. An organization running 60 virtual machines across three ESXi hosts doesn’t have 60 targets – it has three. If those three go offline, so does everything else. For ransomware operators, this architecture creates three decisive advantages: 

1. They achieve maximum operational disruption from a single action.

2. They execute dramatically faster encryption across large datasets.

3. They gain substantial ransom leverage because conventional backup systems cannot restore data or services quickly.

Inside The Seven-Phase Attack

The Gentlemen do not rely on automated spray-and-pray tactics. Their intrusions are deliberate, employing multi-stage operations designed for stealth, persistence, and large-scale impact. By understanding each phase of their playbook, organizations gain critical insights into where their defenses must hold, as well as common points of failure.

⚠  Technical Note — ChaCha20 Encryption

The Gentlemen use ChaCha20: the same high-speed cipher that powers HTTPS, VPNs, and secure messaging apps. Purpose-built for speed, it can encrypt multi-terabyte virtual datastores within minutes. Persistence mechanisms ensure the ransomware survives unexpected reboots and resumes automatically, preventing any window for recovery intervention.

The Cleanup That Makes Forensics Harder

Sophisticated ransomware operations don’t stop at encryption. Once the damage is done, the Gentlemen systematically remove their binaries, clear command histories, and scrub forensic artifacts. The goal: delay incident response, complicate attribution, and prevent defenders from understanding precisely how the breach succeeded, making future prevention significantly harder and more expensive.

What Makes This Different From Endpoint Ransomware

The architecture of this attack tells a specific story. The Gentlemen don’t assume backups aren’t in place; they plan for, target, and work around them. By actively locating and attempting to disable backup agents (Phase 5). Through double extortion, they ensure that even a successful recovery keeps ransom pressure alive.

Since this unique threat model differs from the endpoint-centric attacks organizations designed their defenses around, it demands a fundamentally different response.

“Modern ransomware actors focus heavily on locating and disabling backups to strip victims of their recovery options. Organizations must build their resilience postures with this specific threat in mind.”

Changing The Calcus: Three Principles of Cyber Resilience

The answer to such ransomware isn’t better endpoint protection or faster incident response. Its structural separation ensures that backup and recovery environments cannot be reached, altered, compromised, or encrypted by attackers that achieve domain-level access in your production infrastructure.

The Resilience Standard

Cyber resilience isn't about preventing every attack. It’s about ensuring that no breaches, regardless of sophistication or access level, can permanently compromise your ability to recover. Organizations that structurally separate their recovery posture from their production environment remove the most dangerous assumption attackers make: that your backups are within reach.

What Defenders Should Do Right Now

Organizations running virtualized environments should treat hypervisor security as a tier-one priority on par with identity and endpoint protection. Practically, that means taking several immediate steps:

1. Audit your ESXi access controls. Administrative access to your hypervisor layer should be tightly scoped, multi-factor protected, and ideally managed through privileged access workstations that are fully isolated from your general corporate network. 
2. Examine your backup architecture honestly. If your actual backup runs inside the same Active Directory domain that attackers can compromise, your backups are within the attack blast radius. The Gentlemen’s attack chain (Phase 5) exists specifically to find and neutralize them, requiring that backup utilities live outside production environments to protect against domain-level compromise.
3. Invest in proactive detection. Missed signals during the reconnaissance and lateral movement phases limit awareness to when the attack has already succeeded (Phase 7). Detection opportunities against unusual AD enumeration patterns (Phase 2), credential access (Phase 3), and anomalous admin tool usage across multiple hosts (Phase 4) offer early warning indications of risk. By focusing detection resources on the endpoint or perimeter, you create a blind spot to stealthy adversarial movements within your environment. 
4. Test your recovery operationally, not theoretically. Can your team restore a complete ESXi environment from a known-good backup under adversarial conditions, in a timeframe that keeps the business viable? If you do not routinely and actively test your recoverability posture, you may not be prepared to respond when your business needs it most.

The Bottom Line for Security Leaders

The Gentlemen ESXi ransomware campaign is a clear signal of where the threat landscape is heading. Ransomware operators are weaponizing identity, climbing the infrastructure stack, and targeting the layers that control the most assets with the fewest individual targets. A single successful hypervisor compromise can produce more operational disruption than hundreds of endpoint infections, further driving attacker behavior in this direction.

The organizations that will weather this threat most successfully are not those with the most endpoint agents deployed. They are the ones that have built cyber resilience into their data architecture, structurally separating their recovery capability so that even a worst-case compromise leaves the recovery path intact, trustworthy, and fast.

Resilience is not a feature. It’s an architectural commitment. Now is the time to make it.

See How Druva Protects ESXi Environments

• Druva's immutable, air-gapped solution

• How to manage vCenter or ESXi servers

• Getting started with protecting VMware VMs

• Orchestrating VM restores with Recovery Runbooks

• Securing and defending against identity-based attacks