Do Son China-nexus WARP PANDA APT targets VMware/Azure with BRICKSTORM, a Golang backdoor using DoH for stealth. The group creates "ghost VMs" and conducts session replay attacks for long-term espionage.
vCenter
Broadcom patches three vulnerabilities in VMware vCenter and NSX. The flaws could lead to SMTP header injection and username enumeration, increasing the risk of unauthorized access.
Sygnia uncovers "Fire Ant," a sophisticated cyber-espionage campaign exploiting VMware ESXi and vCenter since early 2025, using advanced techniques to evade detection and maintain persistent access.
Broadcom addresses four new vulnerabilities in VMware ESXi, vCenter, Workstation, and Fusion, ranging from command execution to XSS. Update now.