SCATTERED SPIDER IS RUNNING A VMWARE ESXI HACKING SPREE

Summary from the TLDR InfoSec newsletter

Scattered Spider is targeting VMware ESXi hypervisors across retail, airline, transportation, and insurance sectors using social engineering to impersonate employees and trick IT help desks into resetting passwords for privileged accounts. Once they gain vCenter access, attackers enable SSH on ESXi hosts, perform "disk-swap" attacks to extract the NTDS.dit Active Directory database, wipe backups, and deploy ransomware to encrypt all VMs in the datastores. Google recommends hardening vSphere with execInstalledOnly, VM encryption, disabled SSH, phishing-resistant MFA, isolating Tier 0 assets, and centralizing logs in a SIEM to detect suspicious vCenter logins and configuration changes.