The Cyber Bulletin: VMware vSphere and Active Directory Integration

As organisations continue to modernise and virtualise their infrastructure, many rely on VMware vSphere for its stability and control. However, recent threat intelligence from Mandiant and Google Cloud highlights a critical and often overlooked risk: the direct integration of vSphere with Microsoft Active Directory (AD).

While this integration simplifies identity management, it also creates a high-value attack path. A compromise of AD credentials can lead to full administrative control over ESXi hosts and vCenter servers - effectively handing over the keys to the entire virtual estate. This is particularly concerning given the rise of hypervisor-aware ransomware, which targets the infrastructure itself rather than individual endpoints.

Mandiant has observed a growing trend of threat actors exploiting this integration. Attackers are increasingly bypassing traditional endpoint defences by targeting the ESXi hypervisor directly, which lacks support for modern security tools like EDR agents and MFA.

The Likewise agent, used to facilitate AD integration, is deprecated and does not support modern authentication protocols or multi-factor authentication. This leaves ESXi and vCenter environments vulnerable to credential theft, privilege escalation, and mass ransomware deployment.

The risks are compounded by insecure default configurations. For example, when ESXi is joined to AD, the “ESX Admins” group is automatically granted root-level access. This trust model means that any compromise of AD can cascade into full control of the virtual infrastructure.

Organisations must act now. With vSphere 7 reaching end-of-life in October 2025, many environments will soon be unsupported, increasing the risk of exploitation. This transition presents a critical opportunity to re-architect for security rather than simply upgrade.

Key recommendations include:

• Decoupling ESXi from AD to reduce the attack surface.

• Implementing modern identity federation with phishing-resistant MFA for vCenter access.

• Hardening ESXi and vCenter configurations, including Secure Boot, TPM, and Lockdown Mode.

• Enhancing visibility through SIEM integration and hypervisor-level logging.

• Isolating Tier 0 assets, such as AD Domain Controllers, in dedicated, highly secured vSphere environments.

The full technical breakdown and mitigation guidance is available via the original article which you can read here: https://cloud.google.com/blog/topics/threat-intelligence/vsphere-active-directory-integration-risks

---

Reporting

Report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online. Forward suspicious emails to report@phishing.gov.uk. Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).

---