🖥️ Honey ESXi Host

An emulated ESXi hypervisor with a decoy datastore and decoy virtual machines.

→ Explore in ATT&CK matrix (3 mappings) Deployment detail

What it is

Deploy an ESXi-like host (an emulator, or a real isolated ESXi with decoy VMs) on the management network. Ransomware crews that reach the virtualisation layer log in over SSH, list and stop virtual machines, then encrypt the datastore under /vmfs/volumes. On the decoy every one of those steps is recorded, and encryption of the decoy datastore is an unambiguous signal.

Implementation requirements

An isolated ESXi host, or an emulator reproducing the ESXi shell, esxcli and vim-cmd, and the /vmfs/volumes layout
Decoy virtual machines with believable names and sizes; no real workloads
Forward shell, management-service and authentication logs; alert on any login, any VM power operation and any write under /vmfs/volumes
Network isolation so a compromised decoy cannot reach production hosts or vCenter
Safety: no credential on the decoy is valid anywhere else
Rollback: Take an evidence snapshot, then shut down the host and remove its management-network address.
Upkeep: Keep version banners current. Monthly proof-of-life SSH login.

Cost

Moderate. A host or emulator plus storage for decoy VMs, and upkeep to stay believable.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

Endpoint

ATT&CK coverage 3

Technique	Tactic	Status	Confidence	Tier
T1673 Virtual Machine Discovery	Discovery	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware — eCrime groups reach ESXi over SSH, list and terminate running VMs, then encrypt /vmfs/volumes. Deception-Based Proactive Defense Against Ransomware in VMware ESXi Systems — An emulated ESXi honeypot with decoy files and services was deployed to lure and observe ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1673 Virtual Machine Discovery as an adversary behaviour.
T1675 ESXi Administration Command	Execution	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Deception-Based Proactive Defense Against Ransomware in VMware ESXi Systems — An emulated ESXi honeypot with decoy files and services was deployed to lure and observe ransomware. Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware — eCrime groups reach ESXi over SSH, list and terminate running VMs, then encrypt /vmfs/volumes. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1675 ESXi Administration Command as an adversary behaviour.
T1486 Data Encrypted for Impact	Impact	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Ransomware in the honeypot: how we capture keys with sticky canary files — Elastic Endpoint (since 7.14) plants canary files; any process writing to them is flagged as ransomware with high confidence, and since 8.11 its memory is dumped. Deception-Based Proactive Defense Against Ransomware in VMware ESXi Systems — An emulated ESXi honeypot with decoy files and services was deployed to lure and observe ransomware. Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware — eCrime groups reach ESXi over SSH, list and terminate running VMs, then encrypt /vmfs/volumes.

Evidence

Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros, V.; Catania, C.; Lisý, V.; Griffioen, H., Stratosphere Laboratory, Czech Technical University in Prague 2026 preprint
Deception-Based Proactive Defense Against Ransomware in VMware ESXi Systems — Nguyen, A.-N.; Tran Thi, T. T.; Tran, H.-H.; Do, M.-Q.; Nguyen, N.-N.; Trinh, T.-S.; Luu, M.-T.; Ngo, T.-S., ASIANComNet 2024 peer-reviewed
Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware — CrowdStrike 2021 industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Nguyen et al. (ASIANComNet 2024) deploy an emulated ESXi honeypot to lure and observe ransomware. CrowdStrike (2021) documents eCrime groups targeting ESXi: SSH access, termination of running VMs, then encryption of /vmfs/volumes.