If you have ever deployed a VMware VM on VMware ESXi, VMware Workstation, VMware Player, or VMware Fusion, you’ve probably noticed that after installing a guest operating system (OS), you are asked to install VMware Tools. In this blog post, we cover what VMWare Tools is and the VMware Tools installation process on different operating systems including Linux, Windows, macOS, FreeBSD, and Solaris.

In the modern Kubernetes ecosystem, VMware Tanzu has emerged as a popular platform for enterprises deploying containerized workloads. To meet Tanzu Backup and disaster recovery needs, Tanzu relies on Velero, an open-source solution, for backing up and restoring cluster resources and persistent volumes.

In a recent development, cybersecurity researchers have identified a new Linux variant of the notorious Play ransomware, also known as Balloonfly and PlayCrypt. This variant specifically targets VMware ESXi environments, signaling a strategic expansion by the threat actors behind it. Trend Micro's report published on Friday highlights the potential for a broader victim pool and more effective ransom negotiations as a result of this evolution.

On June 17, 2024, VMware disclosed two critical vulnerabilities (CVE-2024-37079 & CVE-2024-37080) affecting vCenter Server and Cloud Foundation. These vulnerabilities stem from a heap-overflow issue in the implementation of the DCERPC protocol which can be exploited by remote threat actors. By sending specially crafted network packets, threat actors could exploit CVE-2024-37079 and CVE-2024-37080 to achieve Remote Code Execution (RCE) on both vCenter Server and Cloud Foundation systems.

Novel Attack Vector Uses Custom Shell for Payload Delivery and Execution A fresh variant of the Mallox ransomware has emerged, specifically targeting VMware ESXi environments with administrative privileges. This advanced attack method, discovered by researchers at Trend Micro, demonstrates the evolving sophistication of ransomware tactics. Mallox Ransomware: An Overview Mallox, also known as Fargo and Tohnichi, first emerged in June 2021.

CrowdStrike Falcon Next-Gen SIEM, the definitive AI-native platform for detecting, investigating and hunting down threats, enables advanced detection of ransomware targeting VMware ESXi environments. CrowdStrike has observed numerous eCrime actors exploiting ESXi infrastructure to encrypt virtual machine volumes from the hypervisor to deploy ransomware in organizations. Access to ESXi infrastructure typically takes place as part of lateral movement.

Humans don’t like change. Whether it’s saying goodbye to your favorite pair of jeans, moving to a new house, or trying a new kind of coffee, we often resist change. But sometimes change is forced on us. For example: Over the past month or so, Broadcom rolled out tremendous changes to VMware licensing. This is why many of our customers and partners are wondering what the changes will mean to them.

In our new threat briefing report, Forescout’s Vedere Labs provides details on the recent ransomware campaign targeting VMware ESXi virtualization servers, or hypervisors, and analyzes two payloads used in these attacks: variants of the Royal and Clop ransomware. We also present the tactics, techniques and procedures (TTPs) used by attackers in this campaign, discuss mitigation recommendations and list indicators of compromise (IOCs) that can be used for detection or threat hunting.

On Tuesday, January 24th, 2023, VMware disclosed two critical vulnerabilities in VMware vRealize Log Insight that could result in remote code execution (RCE). Although different vulnerability types, both vulnerabilities could allow an unauthenticated threat actor to inject files into the operating system of the vulnerable product which could result in RCE. Both vulnerabilities were responsibly disclosed to VMware and have not been actively exploited in campaigns.