Morning Threat Brief: Ransomware reached the hypervisor through a monitoring tool, a library system goes dark, freezers draw a federal warning, and DigiCert confirms a breach

Good morning. Two ransomware cases published today never broke a virtual machine boundary: they walked in through a monitoring tool and a plaintext password note. A ransomware attack shut down the digital services of New York's largest public library system, five federal agencies warned that hackers are turning up the heat on industrial freezers, and DigiCert confirmed a breach that reached archived customer records, including identity documents for some. Check your hypervisor credentials, and if you are a DigiCert customer, watch for their notice.

1. Ransomware reached the hypervisor through the monitoring tool: no exploit, just credentials (BlackNevas, The Gentlemen). Kaspersky published two ransomware investigations on November 6, and neither one needed a virtual machine escape. In the first, BlackNevas ransomware hit VMware ESXi hosts after the attacker reached the site's PRTG Network Monitor, which stored ESXi root credentials, and the same root password was reused across several hosts. The attacker connected over SSH as root, uploaded an encryptor binary named esx, and when the host's execInstalledOnly policy blocked it, disabled the policy with esxcli and ran it, then deleted the logs. The attack ran October 18 to 19, 2025. BlackNevas is a Trigona-derived family first seen in November 2024. In the second, The Gentlemen ransomware hit a Proxmox cluster after the attacker compromised an administrator's workstation and found privileged credentials and access details stored in plaintext notes. The attacker logged in as root@pam and used the Proxmox VNC websocket to reach node consoles, then downloaded and ran the ransomware inside the cluster, encrypting the whole environment, between January 1 and 8, 2026. The Gentlemen is a ransomware as a service operation that emerged around mid-2025. Tools seen across the cases include AnyDesk, Cobalt Strike, Mimikatz, SystemBC, and GMER. No CVE was exploited in either case. The fix is credential hygiene: unique vaulted hypervisor passwords, dedicated least privilege monitoring identities, Lockdown Mode and SSH off on ESXi, and no privileged credentials in plaintext notes. Alert on execInstalledOnly changes and on root@pam VNC websocket sessions, and forward hypervisor logs off the box so an attacker cannot erase them.

2. Queens Public Library confirms ransomware: 66 branches, 2.3 million people, no checkout machines. New York's Queens Public Library confirmed on Wednesday, November 4, that a ransomware attack is behind the systemwide outage that began November 4. The library's website, on-site computers, checkout and return machines, public Wi-Fi, mobile app, and digital media services are all down, though all 66 locations remain open. The library is working with the New York City Police Department, federal law enforcement partners, City Hall, and cybersecurity specialists, and says restoration will take time. No ransomware group has claimed the attack, and the library has not said whether personal data was taken. If you use the library, expect manual processes for now, watch the library's official updates, and do not worry about late fines: the library says customers are not charged late fines on borrowed materials during the outage.

3. Five federal agencies warn that hackers are turning up the heat on freezers. CISA, the FBI, and the Departments of Agriculture, Health and Human Services, and Transportation issued a joint advisory on November 5 warning of an ongoing cyber threat to industrial refrigeration and cold chain monitoring systems. The warning follows attacks on supermarket refrigeration in Europe, including a French blood bank whose cold storage monitoring was hit, and a reported investigation into freezer hacks at US military bases. Attackers can change temperature settings or force units into continuous heating and defrost cycles, which can cause fire hazards, lost inventory, and damaged equipment. Censys data published November 5 showed a 53 percent drop in internet exposed controllers for the affected Danfoss and Copeland/Dixell products since the attacks, which is progress, not a clean bill of health. The agencies urge operators to take refrigeration controllers off the public internet, change and strengthen passwords, patch firmware, and retire equipment the vendor no longer supports. The advisory names no group or country. Researchers have broadly pointed to Iran, and US officials reportedly suspect the same, but that attribution is unconfirmed. If your business depends on refrigeration, assume it is a target and check whether any controller is reachable from the internet today.

4. DigiCert confirms a breach that reached archived customer records, including identity documents. Certificate authority DigiCert told customers on November 5 that a February 2025 server migration mistakenly exposed an internal business system to the internet, where it had previously been reachable only by VPN. The system had a self-registration feature that let outsiders create accounts, and an unauthorized account read archived customer data between June 27 and July 2, 2026. The exposed data includes names, business email addresses, phone numbers, and business addresses, and for a small number of accounts, identity documents such as driver licenses, passports, and utility bills submitted during certificate validation. DigiCert discovered the unauthorized accounts in June 2026 but only confirmed data access on October 19, after a deeper log review. The access was read only: the account could not change records, approve validations, or issue certificates, and DigiCert says its certificate authority services, CertCentral, and DigiCert ONE were not compromised, and customer login credentials and issued certificates remain secure. DigiCert has not said how many people are affected and is still reviewing the identity documents to determine who to notify. If you are a DigiCert customer, watch for their notice, and if you submitted an identity document for validation, treat it as exposed and watch for identity theft.

Warning: the WordPress KEV deadline is today, Friday, November 6. If WordPress is still unpatched, patch it now. The VMware ESX flaw CVE-2026-41709 is due November 11, the second Ivanti flaw CVE-2026-118527 is due Friday, November 13, and the Apple KEV entry CVE-2024-27834 is due November 18.

Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library

New CISA KEV additions today: none. The catalog stands at 1,768 entries, last updated November 4.

← kevintswaney.com