FIRE ANT: A DEEP-DIVE INTO HYPERVISOR-LEVEL ESPIONAGE

Summary from the TLDR InfoSec newsletter

Cybersecurity firm Sygnia has been tracking a campaign targeting VMware ESXi, vCenter, and network appliances to compromise environments. The attackers compromise the hypervisor by exploiting CVE-2023-34048 to obtain code execution and install an HTTP backdoor on the hypervisors. The attackers then used PowerCLI commands to compromise guests without guest credentials and also ran unregistered VMs with the VMware CLI to bypass registration in vCenter.