CRITICAL VMWARE VCENTER RCE FLAW EXPLOITED FOR REVERSE SSH ACCESS

Summary from the TLDR InfoSec newsletter

Digital forensics firm QUIRSO reports that a recently patched, critical vulnerability in VMware vCenter Syslog Server is actively being exploited by threat actors. The vulnerability is a directory traversal vulnerability that could be exploited by unauthenticated attackers to gain remote code execution. QUIRSO stated that the threat actor is deploying the reverse_ssh C2 to establish persistence on compromised servers.