VIRTUALPIE
S1218 · ESXi
VIRTUALPIE is a lightweight backdoor written in Python that spawns an IPv6 listener on a VMware ESXi server and features command line execution, file transfer, and reverse shell capabilities. VIRTUALPIE has been in use since at least 2022 including by UNC3886 who installed it via malicious vSphere Installation Bundles (VIBs).
ATT&CK S1218
Sigma rules0
YARA rules0
Live IOCs0