{"id":48645,"date":"2022-09-29T13:00:09","date_gmt":"2022-09-29T13:00:09","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/covert-malware-targets-vmware-shops-for-hypervisor-level-espionage\/"},"modified":"2022-09-29T13:00:09","modified_gmt":"2022-09-29T13:00:09","slug":"covert-malware-targets-vmware-shops-for-hypervisor-level-espionage","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/covert-malware-targets-vmware-shops-for-hypervisor-level-espionage\/","title":{"rendered":"Covert malware targets VMware shops for hypervisor-level espionage"},"content":{"rendered":"

Emerging covert malware can target VMware environments to allow criminals to gain persistent administrative access to hypervisors, transfer files, and execute arbitrary commands on virtual machines, according to VMware and Mandiant, which discovered such a software nasty in the wild earlier this year.<\/p>\n

Mandiant, the now-Google-owned<\/a> threat intel team, attributed the infections to an uncategorized group it calls UNC3886 and says it suspects the snoops’ motivation to be espionage. Mandiant also asserts “with low confidence” that the gang has ties to China.<\/p>\n

In research<\/a> published today, Mandiant noted that, to develop and deploy this spyware, its mastermind would need a fairly deep level of understanding of VMware’s ESXi operating system as well as admin-level privileges to a victim’s ESXi hypervisor installation.<\/p>\n