S1218 VIRTUALPIE

malwareEnterprise

platformsESXi

also known asVIRTUALPIE

VIRTUALPIE is a lightweight backdoor written in Python that spawns an IPv6 listener on a VMware ESXi server and features command line execution, file transfer, and reverse shell capabilities. VIRTUALPIE has been in use since at least 2022 including by UNC3886 who installed it via malicious vSphere Installation Bundles (VIBs).

techniques used (6)

ATT&CK techniques this enables or maps to.

T1059.006Python
T1059.012Hypervisor CLI
T1505.006vSphere Installation Bundles
T1570Lateral Tool Transfer
T1571Non-Standard Port
T1573.001Symmetric Cryptography

used by groups (1)

Threat groups associated with this.

G1048UNC3886

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan