VMware ESXi

Reported Context (4)

Dell RecoverPoint for Virtual Machines since at least mid-2024 to create hidden network interfaces on VMware ESXi servers and deploy malware payloads. Critical Dell System Update flaw lets remote attackers gain root access
VMware ESXi produced a cross-tenant guest-to-host escape with multi-tenant infrastructure implications. Pwn2Own Berlin 2026 Uncovers 47 Zero-Days Across AI and Enterprise Products
Over time, Qilin expanded its capabilities to support cross-platform encryption across Windows, Linux, and VMware ESXi environments. Qilin Ransomware Group Expands Cross-Platform Operations and Extortion Tactics
The ransomware initially targeted Windows systems, but a Linux variant was later observed targeting VMware ESXi virtual machines [7]. In 2024, it was assessed that Akira would continue to target ESXi hypervisors, making Akira-Linked SonicWall Intrusion Exfiltrated 2 GB Before Darktrace Contained the Attack

CVE (12)

Malware (5)

People (8)

Threat Actors (5)

MITRE ATT&CK (44)

Vendors (13)

Products (32)

Tools (20)

Industries (6)

Countries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.