Scattered Spider’s Hypervisor Attack on VMware vSphere

Scattered Spider launched a mid-2025 campaign targeting VMware vSphere environments by using social engineering to gain Active Directory access, then exploiting vCenter and ESXi for credential theft and ransomware deployment. They bypass traditional defenses by operating at the hypervisor level, extracting data from offline-mounted virtual disks. This infrastructure-focused attack avoids malware and relies on built-in tools, making detection difficult. The campaign highlights the urgent need for hardened identity controls, vSphere monitoring, and resilient backup strategies.