MITRE ATT&CKsoftware (malware)
S1217 VIRTUALPITA
- Domain
- enterprise
- Platforms
- ESXi, Linux
- Version
- 1.0
- Created
- 2025-06-02
Description
VIRTUALPITA is a passive backdoor with ESXi and Linux vCenter variants capable of command execution, file transfer, and starting and stopping processes. VIRTUALPITA has been in use since at least 2022 including by UNC3886 who leveraged malicious vSphere Installation Bundles (VIBs) for install on ESXi hypervisors.
Related
Uses · MITRE ATT&CK (12)
- T1690 Prevent Command History Logging technique
- T1675 ESXi Administration Command technique
- T1673 Virtual Machine Discovery technique
- T1571 Non-Standard Port technique
- T1570 Lateral Tool Transfer technique
- T1059.004 Unix Shell sub-technique
- T1059.006 Python sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1489 Service Stop technique
- T1037 Boot or Logon Initialization Scripts technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G1048 UNC3886 group
References
- https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence Google Cloud Threat Intelligence ESXi VIBs 2022