#ESXi

2025-12-05

WARP PANDA exploiting VMware vCenter, ESXi & stolen Microsoft 365 tokens
technadu.com/warp-panda-target

• BRICKSTORM, Junction, GuestConduit implants used across layers
• VM snapshots + cloned domain controllers for identity harvesting
• SharePoint data accessed via stolen 365 tokens
• Hidden VMs & log tampering for stealth

#CyberSecurity #VMware #ESXi #vCenter #APT #ThreatIntel #CloudSecurity

WARP PANDA Targets U.S. and Asia Pacific Using BRICKSTORM, vCenter, ESXi and Stolen 365 Tokens to Reach Virtual Machines
The Fury 🐧💻❗️🔥:verified:thefyuuri@infosec.exchange
2025-11-16

For the love of whatever, can #broadcom's damn upgrader for #vmware #vcsa not be so damn rigid? No reason any org would need to add a secondary NIC during the upgrade process so the new VCSA can reach the #esxi host the old one is on?!

I had to quit out of the installer after Stage 1 (standing up the new VCSA server) to manually add the 2nd NIC then manually configure the network files to recognize it as well as add the secondary network's DNS and our proxy before moving on to Stage 2.

Broadcom is awful and has made everything with licencing and pricing complete shite due to their unchecked greed, but from what I've heard and seen, the installer has always been kind of crap. At least we're safe from a another full version upgrade for a while, now (hopefully). #sysadmin #sysadminlife #sysadminproblems

Daniel Kuhl ✌🏻☮️☕️daniel1820815@infosec.exchange
2025-10-30

#CheckPoint Research identified #LockBit rapid resurgence after its disruption in 2024, with a dozen organizations hit in September 2025, half by the new LockBit 5.0 (“ChuongDong”) variant. The group is deploying attacks across #Windows, #Linux, and #ESXi environments in Europe, the Americas, and Asia. LockBit 5.0 adds multi-platform builds, stronger anti-analysis, faster encryption, and more.

blog.checkpoint.com/research/l

2025-10-15

Lỗi `atombios stuck in loop` trong ESXi cho GPU Mi50s đã được khắcquiry bằng cách chỉnh sửa `passthru.map`. Dành cho GPU >16GB VRAM. Các bước: 1. Lấy VendorID/DeviceID từ `lspci -n` (vd: 1002 66a0). 2. Thêm dòng `[1002] [66a0] d3d0 default` vào `/etc/vmware/passthru.map`. 3. Xóa lạiPCIe device trong cài VM, khởi động lại host và VM. Kiểm tra qua `rocm-smi`. Lưu ý: Không thay đổi.status passthrough! Tags: #Passthrough #ESXi #GPU #Troubleshooting #Fix #Tech #ESXiVietnam

reddit.com/r/L

2025-09-29

LockBit 5.0 als neue Ransomaware-as-a-Service

Die neue LockBit-Variante in Version 5 funktioniert nun auch plattformübergreifend in Windows, Linux und VMware-ESXi-Umgebungen. TrendMicro hat die neuen Angriffstechniken analysiert und stellt fest:
"Die Windows-, Linux- und ESXi-Varianten von LockBit 5.0 unterstreichen, dass kein Betriebssystem und keine Plattform als sicher vor modernen Ransomware-Kampagnen angesehen werden kann."
Damit ermögliche die neue Crossplattform-Strategie Angreifenden gleichzeitige Angriffe auf das gesamte Unternehmensnetzwerk.
Die Windows-Variante von LockBit 5.0 nutze eine starke Verschleierung und Komprimierung, indem sie ihre Payload über DLL-Reflexion lade und gleichzeitig Anti-Analyse-Techniken implementiere. Die Linux-Variante verfüge über ähnliche Funktionen mit Befehlszeilenoptionen für bestimmte Verzeichnisse und Dateitypen. Die ESXi-Variante ziele speziell auf die Virtualisierungsinfrastruktur von VMware ab und sei entwickelt worden, um virtuelle Maschinen zu verschlüsseln.
Die neuen Varianten verwenden zufällige 16-stellige Dateierweiterungen, verfügen über eine Umgehung des russischsprachigen Systems und löschen nach der Verschlüsselung die Ereignisprotokolle.
"Die starke Verschleierung dieser neuen Varianten verzögert die Entwicklung von Erkennungssignaturen erheblich, während technische Verbesserungen wie entfernte Infektionsmarker, schnellere Verschlüsselung und verbesserte Umgehungsmöglichkeiten LockBit 5.0 deutlich gefährlicher machen als seine Vorgänger."

trendmicro.com/en_gb/research/

#infosec #ransomware #raas #windows #linux #esxi #vmware #lockbit #BeDiS

2025-09-26

📢 LockBit 5.0 cible Windows, Linux et ESXi avec obfuscation avancée et anti‑analyse
📝 Trend Micro (Trend Research) publie une analyse technique de la nouvelle version « LockBit 5.0 », apparue après l’opération polic...
📖 cyberveille : cyberveille.ch/posts/2025-09-2
🌐 source : trendmicro.com/en_us/research/
#ESXi #IOC #Cyberveille

Cliff Barbiercliffb_infosec
2025-09-04

I may be wrong, but I think that is the only whole product name-checked by in the top-level techniques list. T1675

They don't say "Hypervisor administration command" or anything generic like that. They call out "ESXi administration command" specifically. And that says a lot of bad things about the about that product.

Brian Greenberg :verified:brian_greenberg@infosec.exchange
2025-07-31

🕷️ Scattered Spider is targeting VMware ESXi systems through social engineering alone. They impersonate help‑desk users to gain AD account resets, then elevate privileges to control vCenter and ESXi hosts. From there it’s disk‑swap, NTDS.dit exfiltration, backup sabotage, and ransomware, all in just hours. 🚨

TL;DR
⚠️ ESXi hosts manage entire virtual environments and are now attack vectors
🧠 Social‑engineering to bypass MFA and reset AD credentials
🔐 Disk‑swap to steal NTDS.dit and cripple backups
📈 Rapid ransomware across all VMs using root access

bleepingcomputer.com/news/secu
#ScatteredSpider #ESXi #VMware #IncidentResponse #security #privacy #cloud #infosec #cybersecurity #sysadmin

I've finally completed most of the guides I was planning on adding to my #Homelab Wiki - now it's got guides on setting up #Portainer, #Immich, #Jellyfin, #ErsatzTV, #OpenMediaVault (#OMV), and even #HomeAssistant - all of these (besides Jellyfin and ErsatzTV, those are on #Proxmox) are hosted on my #RaspberryPi in my homelab.

Most importantly though, I've organised the wiki a lil better - into different
courses. The first course details the type of hardware you're going to want to assemble - a beefy server (with only consumer parts) or a mini server (i.e. an #SBC), or whether you'd like to deploy a #NAS, followed by a course to setting up and managing a hypervisor (including #ESXi, but really, use Proxmox - which is #FOSS and plain better).

There's also a whole course on all sorts of 'host deployment environments' (i.e. where your application is hosted on, like
#VM, #Docker, #Kubernetes, and #LXC) you could have in your homelab. (One of the) Most importantly, a course on networking - which covers valuable topics like setting up a domain, free or paid, and setting up a reverse proxy for serving your hosted applications publicly, securely.

There's still some stuffs I gotta add, like a complete guide on setting up
#TrueNAS (which I've set up for many years at this point, without much documentation on how I did it - so I gotta find an opp to replicate it, when I have extra hardware maybe), but I'm pretty happy with it at this point. If you're planning to get into homelabbing, or even if you're already in it - maybe check it out ​:blobfoxcat:​

🔗 https://github.com/irfanhakim-as/homelab-wiki

RE: https://sakurajima.social/notes/a9so79m6ze

:awesome:🐦‍🔥nemo™🐦‍⬛ 🇺🇦🍉nemo@mas.to
2025-07-30

🚨 The notorious hacker group #ScatteredSpider is aggressively targeting #VMware #ESXi hypervisors in US retail, airline & insurance sectors using advanced social engineering 🎭 to breach IT help desks & deploy ransomware from the hypervisor layer in just hours! ⏱️🔐 Read more: bleepingcomputer.com/news/secu #CyberSecurity #Ransomware #InfoSec
#newz

Client Info

Server: https://mastodon.social
Version: 2025.07
Repository: https://github.com/cyevgeniy/lmst