S1217 VIRTUALPITA

malwareEnterprise

platformsESXi · Linux

also known asVIRTUALPITA

VIRTUALPITA is a passive backdoor with ESXi and Linux vCenter variants capable of command execution, file transfer, and starting and stopping processes. VIRTUALPITA has been in use since at least 2022 including by UNC3886 who leveraged malicious vSphere Installation Bundles (VIBs) for install on ESXi hypervisors.

techniques used (12)

ATT&CK techniques this enables or maps to.

T1036.004Masquerade Task or Service
T1036.005Match Legitimate Resource Name or Location
T1037Boot or Logon Initialization Scripts
T1059.004Unix Shell
T1059.006Python
T1105Ingress Tool Transfer
T1489Service Stop
T1570Lateral Tool Transfer
T1571Non-Standard Port
T1673Virtual Machine Discovery
T1675ESXi Administration Command
T1690Prevent Command History Logging

used by groups (1)

Threat groups associated with this.

G1048UNC3886

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan