MITRE ATT&CKsoftware (malware)

S1218 VIRTUALPIE

Published 2025-06-04 Modified 2025-06-04 Official page ↗

Domain: enterprise
Platforms: ESXi
Version: 1.0
Created: 2025-06-04

Description

VIRTUALPIE is a lightweight backdoor written in Python that spawns an IPv6 listener on a VMware ESXi server and features command line execution, file transfer, and reverse shell capabilities. VIRTUALPIE has been in use since at least 2022 including by UNC3886 who installed it via malicious vSphere Installation Bundles (VIBs).

Uses · MITRE ATT&CK (6)

T1505.006 vSphere Installation Bundles sub-technique
T1059.012 Hypervisor CLI sub-technique
T1573.001 Symmetric Cryptography sub-technique
T1571 Non-Standard Port technique
T1570 Lateral Tool Transfer technique
T1059.006 Python sub-technique

Referenced by MITRE ATT&CK · uses (1)

G1048 UNC3886 group

References

https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence Google Cloud Threat Intelligence ESXi VIBs 2022

S1218 VIRTUALPIE

Description

Related

Uses · MITRE ATT&CK (6)

Referenced by MITRE ATT&CK · uses (1)

References