Kaspersky GERT investigated two ransomware incidents in ESXi and Proxmox environments where weak access controls and credential reuse enabled attackers to move from a monitoring platform to full hypervisor control. In the ESXi case, the PRTG Network Monitor server stored a root password that was reused across multiple hosts. After compromising the monitoring system, the threat actor used the shared credential to SSH into ESXi nodes, disabled the execInstalledOnly policy with esxcli, and executed a malicious binary named esx, also deleting logs. The investigation showed that a fully patched hypervisor can still be compromised through a shared password, an over-privileged monitoring account, or an open SSH path, without needing a VM escape. The article highlights the need to combine patching with secure configuration, restricted credential storage, and network segregation across the virtualization stack. 1