Security News > 2022 > December > New Python malware backdoors VMware ESXi servers for remote access
A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.
VMware ESXi is a virtualization platform commonly used in the enterprise to host numerous servers on one device while using CPU and memory resources more effectively.
The new backdoor was discovered by Juniper Networks researchers, who found the backdoor on a VMware ESXi server.
The script's name and location make Juniper Networks believe that the malware operators intend to target VMware ESXi servers specifically.
"The file begins with a VMware copyright consistent with publicly available examples and is taken character-for-character from an existing Python file provided by VMware."
One of the threat actors' actions observed by Juniper's analysts was to change the ESXi reverse HTTP proxy configuration to allow remote access to communicate with the planted webserver.
News URL
Related news
- Chilean hosting firm's VMware ESXi servers hit by new SEXi ransomware (source)
- Hosting firm's VMware ESXi servers hit by new SEXi ransomware (source)
- Week in review: Backdoor found in XZ utilities, weaponized iMessages, Exchange servers at risk (source)
- DinodasRAT malware targets Linux servers in espionage campaign (source)
- Hackers Deploy Python Backdoor in Palo Alto Zero-Day Attack (source)
- Researchers sinkhole PlugX malware server with 2.5 million unique IPs (source)
- Fake job interviews target developers with new Python backdoor (source)
- Android Malware Wpeeper Uses Compromised WordPress Sites to Hide C2 Servers (source)
- Iranian hackers pose as journalists to push backdoor malware (source)