Post

An old idea that still holds true: Fight the enemy where they aren’t. Threat actors take this advice to heart by avoiding Endpoint Detection and Response solutions and targeting systems that do not generally support EDR such as VMware ESXi hosts.

MITRE ATT&CK

@attack.mitre.org

8 May 2025

We’re currently reading Google’s reporting on VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors cloud.google.com/blog/topics/...

cloud.google.comVMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors | Mandiant | Google Cloud Blog

MITRE ATT&CK

@attack.mitre.org

8 May 2025

One of the big updates for ATT&CK v17 was the new platform ESXi which reflects the rise in attacks on virtualization infrastructure. The technique we’re spotlighting today is new to ATT&CK: T1675 ESXi Administration Command attack.mitre.org/techniques/T...

attack.mitre.orgESXi Administration Command, Technique T1675 - Enterprise | MITRE ATT&CK®

MITRE ATT&CK

@attack.mitre.org

8 May 2025

T1675 describes activity in which an adversary abuses ESXi admin services to execute commands on guest machines.

MITRE ATT&CK

@attack.mitre.org

Google’s reporting details UNC3886, Chinese cyber espionage group, using a zero-day vulnerability that enabled the execution of privileged commands across guest virtual machines without authentication of guest credentials from a compromised ESXi host and no default logging on guest VMs.

8/5/25, 12:32 pm0 reposts0 likes

MITRE ATT&CK

@attack.mitre.org

8 May 2025

Read up on Google’s reporting: cloud.google.com/blog/topics/...

cloud.google.comVMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors | Mandiant | Google Cloud Blog

MITRE ATT&CK

@attack.mitre.org

8 May 2025

And make sure to check out the ESXi material on ATT&CK including T1675 cloud.google.com/blog/topics/... And see the entire ATT&CK v17 release for more information medium.com/mitre-attack...