Internal validation & live display

Multiple badges & continuous verification

Faster underwriting decisions

https://images.rankiteo.com/companyimages/vmware.jpeg

VMware Company CyberSecurity Posture

broadcom.com

VMware by Broadcom delivers software that unifies and streamlines hybrid cloud environments for the world’s most complex organizations. By combining public-cloud scale and agility with private-cloud security and performance, we empower our customers to modernize, optimize and protect their apps and businesses everywhere. Capable of deployment in the software-defined data center, cloud environments, any app and the enterprise edge, our comprehensive software portfolio makes global enterprises more innovative, connected, resilient and secure.

VMware A.I CyberSecurity Scoring

VMware

Company Details

Linkedin ID:

vmware

Website:

https://www.broadcom.com/info/vmware

Employees number:

13,658

Number of followers:

2,032,204

NAICS:

5112

Industry Type:

Software Development

Homepage:

broadcom.com

IP Addresses:

555

Company ID:

VMW_1948473

Scan Status:

Completed

VMware Risk Score (AI oriented)

Between 0 and 549

VMware Software Development

Updated: 25/11/2025

Powered by our proprietary A.I cyber incident model
Insurance preferes TPRM score to calculate premium

VMware Global Score (TPRM)

XXXX

VMware Software Development

—

Instant access to detailed risk factors
Benchmark vs. industry & size peers

Vulnerabilities
Findings

VMware Company CyberSecurity News & History

Past Incidents

Attack Types

Entity	Type	Severity	Impact	Seen	Incident Details
Broadcom	Ransomware	85	3	5/2025	BRO4981349111725
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: U.S.-based semiconductor giant Broadcom suffered a third-party ransomware attack in September, targeting Business Systems House (BSH), a partner of its former payroll provider ADP. The breach, attributed to the El Dorado ransomware gang (linked to BlackLock), resulted in the theft of Middle Eastern employees' sensitive data, including birthdates, email addresses, phone numbers, home addresses, national ID numbers, health insurance details (IDs, policy numbers), financial account numbers, salary information, and employment termination dates. While ADP clarified that only a 'small subset' of clients in select Middle Eastern countries were affected and denied direct involvement or ransom payments, the incident occurred during Broadcom’s transition to a new payroll provider. The full scope of the breach remains undisclosed, but the compromised data poses significant risks of identity theft, financial fraud, and reputational harm to affected employees.
Broadcom	Ransomware	85	3	9/2024	BRO3362533111725
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: A ransomware attack targeted Business Systems House (BSH), a Middle Eastern payroll partner of ADP, in September 2024, leading to the theft of Broadcom’s employee data. The compromised data was leaked online in December 2024, but Broadcom was not notified until May 2025—an eight-month delay. The El Dorado ransomware group claimed responsibility, exploiting Broadcom’s ongoing transition between payroll providers. The breach exposed sensitive employee information, including personal and financial details, while Broadcom was still dependent on ADP and BSH for payroll processing. The incident underscores critical vulnerabilities in third-party supply chain security, particularly during vendor transitions, and highlights the prolonged risks of undetected data exfiltration in ransomware attacks. The delayed disclosure further exacerbated reputational and operational risks for Broadcom, a global semiconductor and infrastructure software leader.
Broadcom	Ransomware	100	5	6/2025	BRO3105131112625
Rankiteo Explanation : Attack threatening the organization’s existence Description: Broadcom, a global technology leader valued at hundreds of billions, was among the high-profile victims of Cl0p’s ransomware attack exploiting a zero-day vulnerability in Oracle’s E-Business Suite (CVE-2025-61882 and CVE-2025-21884). The cybercriminal group exfiltrated sensitive corporate and customer data, threatening to leak or sell it unless a ransom was paid. The breach compromised critical systems, risking financial records, proprietary business data, and third-party customer information. Cl0p’s extortion tactics included warnings of public disclosure on their blog, torrent leaks, or sales to malicious actors, amplifying reputational and operational risks. Given Broadcom’s role in semiconductor and infrastructure technology, the attack posed supply chain cascading risks, potentially disrupting clients reliant on its products. Oracle issued emergency patches, but the damage—including data theft, potential regulatory fines, and erosion of stakeholder trust—had already occurred. The incident underscores vulnerabilities in enterprise software dependencies, with Broadcom facing long-term financial and strategic repercussions if the stolen data is weaponized.
Broadcom	Ransomware	100	5	5/2025	BRO0893008112125
Rankiteo Explanation : Attack threatening the organization’s existence Description: The Cl0p ransomware gang breached Broadcom, a $300+ billion semiconductor and infrastructure software leader, by exploiting an unpatched zero-day vulnerability in Oracle E-Business Suite. This ERP platform manages critical operations, including supply chain, financial systems, and customer data, making it a high-value target. The attackers likely exfiltrated sensitive corporate data (potentially including intellectual property, manufacturing secrets, and customer information) before deploying ransomware, following Cl0p’s typical double-extortion tactic. The breach risks operational disruptions in global manufacturing, regulatory penalties for data exposure, and reputational damage due to the involvement of a notorious ransomware group. The use of a zero-day exploit amplifies the threat, as other organizations using Oracle E-Business Suite may face similar attacks until a patch is released. Broadcom has not confirmed the incident, but the alleged compromise aligns with Cl0p’s pattern of targeting high-value enterprises via unpatched vulnerabilities in widely used software.
Broadcom	Vulnerability	25	1	6/2025	BRO809071525
Rankiteo Explanation : Attack without any consequences Description: A critical security vulnerability has been discovered in Broadcom’s Symantec Endpoint Management Suite that enables unauthenticated remote code execution, posing significant risks to enterprise IT infrastructure. The flaw, designated CVE-2025-5333 with a severe CVSS v4.0 score of 9.5, affects multiple versions of the widely-deployed endpoint management solution and has prompted immediate mitigation recommendations from security experts. The vulnerability resides in the Symantec Altiris Inventory Rule Management (IRM) component, specifically targeting an exposed legacy .NET Remoting endpoint.
Broadcom (VMware)	Vulnerability	85	4	6/2023	BRO4592445093025
Rankiteo Explanation : Attack with significant impact with customers data leaks Description: Broadcom patched a high-severity privilege escalation vulnerability (CVE-2025-41244) in VMware Aria Operations and VMware Tools, actively exploited since October 2024 by UNC5174, a Chinese state-sponsored threat actor linked to China’s Ministry of State Security (MSS). The flaw allows an unprivileged local attacker to escalate privileges to root-level code execution by staging a malicious binary in paths like `/tmp/httpd` and exploiting VMware’s service discovery mechanism. UNC5174, known for selling network access to U.S. defense contractors, UK government entities, and Asian institutions, previously exploited CVE-2023-46747 (F5 BIG-IP), CVE-2024-1709 (ConnectWise ScreenConnect), and CVE-2025-31324 (SAP NetWeaver).The vulnerability poses a critical risk as it enables full system compromise, potentially allowing attackers to move laterally across networks, steal sensitive data, or deploy additional malware. While no direct data breach or ransomware was confirmed in this case, the exploitation by a state-backed APT group suggests espionage or pre-positioning for future attacks. Broadcom also patched two other high-severity VMware NSX flaws reported by the NSA, indicating a broader pattern of targeted cyber operations against enterprise infrastructure.
Symantec	Breach	60	3	2/2021	SYM1336271222
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: Security firm Symantec was attacked by a hacker back in February 2021 in which the hackers extracted some of the data. This comprises not only passwords but a list of Symantec clients -- including government agencies. The hacker was able to access a list of clients using Symantec's CloudSOC services, account managers and account numbers.
Symantec	Vulnerability	60	3	06/2016	SYM44121823
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: Tavis Ormandy identified Symantec and Norton flaws that cybercriminals may use to gain access to users' data. There were 17 items on the list of vulnerable Symantec enterprise products. On the Symantec website, these items had been listed as a security advisory. Malware concealed in an executable file had a chance to obtain total access to the computer running the operating system, it was discovered that Symantec decompressed files in the operating system's kernel.
VMware (Broadcom Inc.)	Cyber Attack	100	5	3/2025	VMW1132111092525
Rankiteo Explanation : Attack threatening the organization’s existence Description: Chinese-aligned threat group UNC5221 deployed the BRICKSTORM backdoor on VMware vCenter and ESXi hosts, targeting US legal, tech, and SaaS firms since at least March 2025. The attack exploited zero-day vulnerabilities in network appliances to gain initial access, followed by privilege escalation (MFA bypass, credential harvesting, VM cloning) and lateral movement via stolen credentials. The primary objective was email exfiltration from high-value targets, including key executives, with evidence of file theft from compromised mailboxes. The backdoor established persistence through systemd/rc.local modifications, ensuring survival across reboots, while communicating with a hardcoded C2 server via WebSockets. The 393-day average dwell time allowed deep infiltration, with attackers leveraging Microsoft Entra ID Enterprise Applications to access sensitive emails. Though no ransomware or direct financial fraud was reported, the breach compromised intellectual property, strategic communications, and potentially client-confidential data, posing long-term risks to corporate espionage, supply-chain attacks, and zero-day development by state-backed actors. VMware’s role as a critical infrastructure provider amplifies the impact, as compromised vCenter servers could enable downstream attacks on customer environments. The sophistication of the campaign—including in-memory servlet injections and automated secret-stealer tools—suggests a nation-state-level operation with implications beyond immediate data theft.
VMware	Ransomware	100		7/2025	VMW410073025
Rankiteo Explanation : Attack threatening the organization’s existence Description: Scattered Spider, a cybercriminal group, has recently targeted VMware ESXi hypervisors, encrypting entire virtual machine infrastructures using DragonForce ransomware. This attack cripples critical infrastructure, rendering virtual machines inoperable. The group gained initial access through sophisticated social engineering tactics, escalated privileges to gain administrative control, and deployed remote monitoring tools before executing the ransomware. The attack has led to significant financial damages and operational disruptions.
VMware	Ransomware	100		5/2025	VMW222051225
Rankiteo Explanation : Attack threatening the organization's existence: Attack in which the personal and financial information is compromised, Attack which stop a factory, Attack which take over on all data from a company, Attack which take specific data like patents, Attack in which company is requested to pay a ransom or ransomware involved Description: Hackers are exploiting the legitimate employee monitoring tool Kickidler to obtain login credentials and deploy ransomware encryptors. The attack begins with a poisoned ad on the Google Ads network, leading to a trojanized version of RVTools. This version deploys a backdoor called SMOKEDHAM, which is then used to install Kickidler. The tool is specifically used to target enterprise administrators and their login credentials. The goal is to infiltrate the network and deploy the encryptor. The payloads targeted VMware ESXi infrastructure, encrypting VMDK virtual hard drives. The groups Qilin and Hunters International are focused on cloud backups but have faced challenges due to defenders decoupling backup system authentication from Windows domains.
VMware	Ransomware	100	5	7/2024	VMW000072224
Rankiteo Explanation : Attack threatening the organization’s existence Description: The SEXi ransomware, which recently rebranded itself as APT INC, continues to plague VMware's ESXi servers, causing significant disruptions to services and potentially leaking sensitive customer data. The attacks underscore the critical vulnerabilities within the ESXi platform and the importance of robust security measures to prevent such incidents.
VMware	Ransomware	100	4	3/2025	VMW423032425
Rankiteo Explanation : Attack with significant impact with customers data leaks Description: A series of critical vulnerabilities in VMware's virtualization products have led to a widespread wave of ransomware attacks, compromising the infrastructures of numerous enterprises. Exploiting three CVEs—CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226—attackers gain elevated privileges, escape VM containment and enact widespread encryption. The healthcare and financial sectors were particularly hit, leading to encrypted patient record systems and transaction databases with ransoms ranging from $2 to $5 million. The severity of the impact was exacerbated by oversights in security monitoring, ineffective segmentation, and delay in implementing available patches. Despite the vulnerabilities being patched by Broadcom, the immediate need for urgent patch application and heightened vigilance remains crucial.
Broadcom (VMware)	Vulnerability	60	3	10/2024	VMW3002130103125
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: The article highlights an actively exploited high-severity vulnerability (CVE-2025-41244) in Broadcom’s VMware Aria Operations and VMware Tools, allowing local attackers with non-administrative VM access to escalate privileges to root. Exploited since October 2024 by UNC5174, a Chinese state-sponsored threat actor linked to China’s Ministry of State Security (MSS), the flaw enables attackers to execute arbitrary code at the highest privilege level. The actor has historically targeted U.S. defense contractors, UK government entities, and Asian institutions, selling network access post-compromise. CISA mandated federal agencies patch within three weeks (by November 20, 2025) under BOD 22-01, warning of significant risks to federal enterprise if left unpatched. While no direct data breach or financial loss is reported, the vulnerability’s exploitation could lead to full system compromise, enabling lateral movement, data exfiltration, or deployment of further malware (e.g., ransomware). Given the actor’s ties to state-sponsored espionage, the risk extends to intellectual property theft, supply chain attacks, or disruption of critical operations in defense and government sectors.
Broadcom (VMware)	Vulnerability	85	4	6/2024	VMW2892328103125
Rankiteo Explanation : Attack with significant impact with customers data leaks Description: The CVE-2025-41244 vulnerability in VMware Aria Operations and VMware Tools (with SDMP enabled) was exploited by the Chinese state-sponsored group UNC5174 for espionage targeting Western and Asian institutions, including US defense contractors, UK government agencies, and Asian organizations. The flaw allowed local privilege escalation, enabling attackers with non-admin access to a VM to gain root privileges, facilitating deeper system compromise. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch by November 20, 2025, or discontinue use. Evidence suggests UNC5174 (linked to China’s Ministry of State Security) had been abusing this flaw since mid-2024, alongside other zero-days in Ivanti Cloud Services Appliance (CSA) to breach French government agencies, telcos, finance, and transportation sectors. The exploitation risks unauthorized access to sensitive defense, government, and corporate networks, potentially leading to data exfiltration, lateral movement, and long-term espionage. While no direct data breach or ransomware was confirmed in this case, the targeted nature of the attacks—focusing on high-value institutions—poses severe national security and economic risks if left unpatched.
VMware	Vulnerability	85	3	4/2025	VMW806040125
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: VMware has announced a critical security issue VMSA-2025-0006, a high-severity vulnerability affecting Aria Operations. This vulnerability, CVE-2025-22231, enables attackers with local access to escalate privileges to root level, potentially resulting in full system control. This may lead to unauthorized data access, service disruptions, or further network compromise. Important to note is that exploitation requires existing local administrative access. Targeted systems include VMware Aria Operations, Cloud Foundation, and Telco Cloud platforms. While patches are available, unpatched systems are still at risk. The flaw’s discovery was credited to researchers from MoyunSec Vlab.

Broadcom

Ransomware

Severity: 85

Impact: 3

Seen: 5/2025

Blog:

BRO4981349111725

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: U.S.-based semiconductor giant **Broadcom** suffered a **third-party ransomware attack** in September, targeting **Business Systems House (BSH)**, a partner of its former payroll provider **ADP**. The breach, attributed to the **El Dorado ransomware gang** (linked to BlackLock), resulted in the theft of **Middle Eastern employees' sensitive data**, including birthdates, email addresses, phone numbers, home addresses, national ID numbers, health insurance details (IDs, policy numbers), financial account numbers, salary information, and employment termination dates. While ADP clarified that only a **'small subset' of clients in select Middle Eastern countries** were affected and denied direct involvement or ransom payments, the incident occurred during Broadcom’s transition to a new payroll provider. The full scope of the breach remains undisclosed, but the compromised data poses significant risks of identity theft, financial fraud, and reputational harm to affected employees.

Broadcom

Ransomware

Severity: 85

Impact: 3

Seen: 9/2024

Blog:

BRO3362533111725

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: A ransomware attack targeted **Business Systems House (BSH)**, a Middle Eastern payroll partner of **ADP**, in **September 2024**, leading to the theft of **Broadcom’s employee data**. The compromised data was leaked online in **December 2024**, but Broadcom was not notified until **May 2025**—an eight-month delay. The **El Dorado ransomware group** claimed responsibility, exploiting Broadcom’s ongoing transition between payroll providers. The breach exposed sensitive employee information, including personal and financial details, while Broadcom was still dependent on ADP and BSH for payroll processing. The incident underscores critical vulnerabilities in **third-party supply chain security**, particularly during vendor transitions, and highlights the prolonged risks of undetected data exfiltration in ransomware attacks. The delayed disclosure further exacerbated reputational and operational risks for Broadcom, a global semiconductor and infrastructure software leader.

Broadcom

Ransomware

Severity: 100

Impact: 5

Seen: 6/2025

Blog:

BRO3105131112625

Rankiteo Explanation

Attack threatening the organization’s existence

Description: Broadcom, a global technology leader valued at hundreds of billions, was among the high-profile victims of **Cl0p’s ransomware attack** exploiting a **zero-day vulnerability in Oracle’s E-Business Suite (CVE-2025-61882 and CVE-2025-21884)**. The cybercriminal group **exfiltrated sensitive corporate and customer data**, threatening to leak or sell it unless a ransom was paid. The breach compromised critical systems, risking **financial records, proprietary business data, and third-party customer information**. Cl0p’s extortion tactics included warnings of **public disclosure on their blog, torrent leaks, or sales to malicious actors**, amplifying reputational and operational risks. Given Broadcom’s role in semiconductor and infrastructure technology, the attack posed **supply chain cascading risks**, potentially disrupting clients reliant on its products. Oracle issued emergency patches, but the damage—including **data theft, potential regulatory fines, and erosion of stakeholder trust**—had already occurred. The incident underscores vulnerabilities in enterprise software dependencies, with Broadcom facing **long-term financial and strategic repercussions** if the stolen data is weaponized.

Broadcom

Ransomware

Severity: 100

Impact: 5

Seen: 5/2025

Blog:

BRO0893008112125

Rankiteo Explanation

Attack threatening the organization’s existence

Description: The **Cl0p ransomware gang** breached **Broadcom**, a $300+ billion semiconductor and infrastructure software leader, by exploiting an **unpatched zero-day vulnerability in Oracle E-Business Suite**. This ERP platform manages critical operations, including **supply chain, financial systems, and customer data**, making it a high-value target. The attackers likely **exfiltrated sensitive corporate data** (potentially including **intellectual property, manufacturing secrets, and customer information**) before deploying ransomware, following Cl0p’s typical double-extortion tactic. The breach risks **operational disruptions in global manufacturing**, **regulatory penalties for data exposure**, and **reputational damage** due to the involvement of a notorious ransomware group. The use of a **zero-day exploit** amplifies the threat, as other organizations using Oracle E-Business Suite may face similar attacks until a patch is released. Broadcom has not confirmed the incident, but the alleged compromise aligns with Cl0p’s pattern of targeting **high-value enterprises** via unpatched vulnerabilities in widely used software.

Broadcom

Vulnerability

Severity: 25

Impact: 1

Seen: 6/2025

Blog:

BRO809071525

Rankiteo Explanation

Attack without any consequences

Description: A critical security vulnerability has been discovered in Broadcom’s Symantec Endpoint Management Suite that enables unauthenticated remote code execution, posing significant risks to enterprise IT infrastructure. The flaw, designated CVE-2025-5333 with a severe CVSS v4.0 score of 9.5, affects multiple versions of the widely-deployed endpoint management solution and has prompted immediate mitigation recommendations from security experts. The vulnerability resides in the Symantec Altiris Inventory Rule Management (IRM) component, specifically targeting an exposed legacy .NET Remoting endpoint.

Broadcom (VMware)

Vulnerability

Severity: 85

Impact: 4

Seen: 6/2023

Blog:

BRO4592445093025

Rankiteo Explanation

Attack with significant impact with customers data leaks

Description: Broadcom patched a **high-severity privilege escalation vulnerability (CVE-2025-41244)** in **VMware Aria Operations** and **VMware Tools**, actively exploited since **October 2024** by **UNC5174**, a **Chinese state-sponsored threat actor** linked to China’s Ministry of State Security (MSS). The flaw allows an **unprivileged local attacker** to escalate privileges to **root-level code execution** by staging a malicious binary in paths like `/tmp/httpd` and exploiting VMware’s service discovery mechanism. UNC5174, known for selling network access to **U.S. defense contractors, UK government entities, and Asian institutions**, previously exploited **CVE-2023-46747 (F5 BIG-IP)**, **CVE-2024-1709 (ConnectWise ScreenConnect)**, and **CVE-2025-31324 (SAP NetWeaver)**.The vulnerability poses a **critical risk** as it enables **full system compromise**, potentially allowing attackers to **move laterally across networks**, **steal sensitive data**, or **deploy additional malware**. While no **direct data breach or ransomware** was confirmed in this case, the exploitation by a **state-backed APT group** suggests **espionage or pre-positioning for future attacks**. Broadcom also patched **two other high-severity VMware NSX flaws** reported by the **NSA**, indicating a broader pattern of **targeted cyber operations** against enterprise infrastructure.

Symantec

Breach

Severity: 60

Impact: 3

Seen: 2/2021

Blog:

SYM1336271222

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: Security firm Symantec was attacked by a hacker back in February 2021 in which the hackers extracted some of the data. This comprises not only passwords but a list of Symantec clients -- including government agencies. The hacker was able to access a list of clients using Symantec's CloudSOC services, account managers and account numbers.

Symantec

Vulnerability

Severity: 60

Impact: 3

Seen: 06/2016

Blog:

SYM44121823

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: Tavis Ormandy identified Symantec and Norton flaws that cybercriminals may use to gain access to users' data. There were 17 items on the list of vulnerable Symantec enterprise products. On the Symantec website, these items had been listed as a security advisory. Malware concealed in an executable file had a chance to obtain total access to the computer running the operating system, it was discovered that Symantec decompressed files in the operating system's kernel.

VMware (Broadcom Inc.)

Cyber Attack

Severity: 100

Impact: 5

Seen: 3/2025

Blog:

VMW1132111092525

Rankiteo Explanation

Attack threatening the organization’s existence

Description: Chinese-aligned threat group **UNC5221** deployed the **BRICKSTORM backdoor** on **VMware vCenter and ESXi hosts**, targeting US legal, tech, and SaaS firms since at least **March 2025**. The attack exploited **zero-day vulnerabilities** in network appliances to gain initial access, followed by **privilege escalation** (MFA bypass, credential harvesting, VM cloning) and **lateral movement** via stolen credentials. The primary objective was **email exfiltration** from high-value targets, including key executives, with evidence of **file theft from compromised mailboxes**. The backdoor established persistence through **systemd/rc.local modifications**, ensuring survival across reboots, while communicating with a **hardcoded C2 server** via WebSockets. The **393-day average dwell time** allowed deep infiltration, with attackers leveraging **Microsoft Entra ID Enterprise Applications** to access sensitive emails. Though no **ransomware** or **direct financial fraud** was reported, the breach compromised **intellectual property, strategic communications, and potentially client-confidential data**, posing long-term risks to **corporate espionage, supply-chain attacks, and zero-day development** by state-backed actors. VMware’s role as a **critical infrastructure provider** amplifies the impact, as compromised vCenter servers could enable **downstream attacks** on customer environments. The sophistication of the campaign—including **in-memory servlet injections** and **automated secret-stealer tools**—suggests a **nation-state-level operation** with implications beyond immediate data theft.

VMware

Ransomware

Severity: 100

Impact:

Seen: 7/2025

Blog:

VMW410073025

Rankiteo Explanation

Attack threatening the organization’s existence

Description: Scattered Spider, a cybercriminal group, has recently targeted VMware ESXi hypervisors, encrypting entire virtual machine infrastructures using DragonForce ransomware. This attack cripples critical infrastructure, rendering virtual machines inoperable. The group gained initial access through sophisticated social engineering tactics, escalated privileges to gain administrative control, and deployed remote monitoring tools before executing the ransomware. The attack has led to significant financial damages and operational disruptions.

VMware

Ransomware

Severity: 100

Impact:

Seen: 5/2025

Blog:

VMW222051225

Rankiteo Explanation

Attack threatening the organization's existence: Attack in which the personal and financial information is compromised, Attack which stop a factory, Attack which take over on all data from a company, Attack which take specific data like patents, Attack in which company is requested to pay a ransom or ransomware involved

Description: Hackers are exploiting the legitimate employee monitoring tool Kickidler to obtain login credentials and deploy ransomware encryptors. The attack begins with a poisoned ad on the Google Ads network, leading to a trojanized version of RVTools. This version deploys a backdoor called SMOKEDHAM, which is then used to install Kickidler. The tool is specifically used to target enterprise administrators and their login credentials. The goal is to infiltrate the network and deploy the encryptor. The payloads targeted VMware ESXi infrastructure, encrypting VMDK virtual hard drives. The groups Qilin and Hunters International are focused on cloud backups but have faced challenges due to defenders decoupling backup system authentication from Windows domains.

VMware

Ransomware

Severity: 100

Impact: 5

Seen: 7/2024

Blog:

VMW000072224

Rankiteo Explanation

Attack threatening the organization’s existence

Description: The SEXi ransomware, which recently rebranded itself as APT INC, continues to plague VMware's ESXi servers, causing significant disruptions to services and potentially leaking sensitive customer data. The attacks underscore the critical vulnerabilities within the ESXi platform and the importance of robust security measures to prevent such incidents.

VMware

Ransomware

Severity: 100

Impact: 4

Seen: 3/2025

Blog:

VMW423032425

Rankiteo Explanation

Attack with significant impact with customers data leaks

Description: A series of critical vulnerabilities in VMware's virtualization products have led to a widespread wave of ransomware attacks, compromising the infrastructures of numerous enterprises. Exploiting three CVEs—CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226—attackers gain elevated privileges, escape VM containment and enact widespread encryption. The healthcare and financial sectors were particularly hit, leading to encrypted patient record systems and transaction databases with ransoms ranging from $2 to $5 million. The severity of the impact was exacerbated by oversights in security monitoring, ineffective segmentation, and delay in implementing available patches. Despite the vulnerabilities being patched by Broadcom, the immediate need for urgent patch application and heightened vigilance remains crucial.

Broadcom (VMware)

Vulnerability

Severity: 60

Impact: 3

Seen: 10/2024

Blog:

VMW3002130103125

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: The article highlights an actively exploited high-severity vulnerability (**CVE-2025-41244**) in **Broadcom’s VMware Aria Operations and VMware Tools**, allowing local attackers with non-administrative VM access to escalate privileges to **root**. Exploited since **October 2024** by **UNC5174**, a Chinese state-sponsored threat actor linked to China’s Ministry of State Security (MSS), the flaw enables attackers to execute arbitrary code at the highest privilege level. The actor has historically targeted **U.S. defense contractors, UK government entities, and Asian institutions**, selling network access post-compromise. CISA mandated federal agencies patch within **three weeks** (by **November 20, 2025**) under **BOD 22-01**, warning of **significant risks to federal enterprise** if left unpatched. While no direct data breach or financial loss is reported, the vulnerability’s exploitation could lead to **full system compromise**, enabling lateral movement, data exfiltration, or deployment of further malware (e.g., ransomware). Given the actor’s ties to **state-sponsored espionage**, the risk extends to **intellectual property theft, supply chain attacks, or disruption of critical operations** in defense and government sectors.

Broadcom (VMware)

Vulnerability

Severity: 85

Impact: 4

Seen: 6/2024

Blog:

VMW2892328103125

Rankiteo Explanation

Attack with significant impact with customers data leaks

Description: The **CVE-2025-41244** vulnerability in **VMware Aria Operations and VMware Tools** (with SDMP enabled) was exploited by the **Chinese state-sponsored group UNC5174** for **espionage** targeting **Western and Asian institutions**, including **US defense contractors, UK government agencies, and Asian organizations**. The flaw allowed **local privilege escalation**, enabling attackers with non-admin access to a VM to gain **root privileges**, facilitating deeper system compromise. The **US Cybersecurity and Infrastructure Security Agency (CISA)** added it to the **Known Exploited Vulnerabilities (KEV) catalog**, mandating federal agencies to patch by **November 20, 2025**, or discontinue use. Evidence suggests **UNC5174 (linked to China’s Ministry of State Security)** had been abusing this flaw since **mid-2024**, alongside other zero-days in **Ivanti Cloud Services Appliance (CSA)** to breach **French government agencies, telcos, finance, and transportation sectors**. The exploitation risks **unauthorized access to sensitive defense, government, and corporate networks**, potentially leading to **data exfiltration, lateral movement, and long-term espionage**. While no direct **data breach or ransomware** was confirmed in this case, the **targeted nature of the attacks**—focusing on **high-value institutions**—poses severe **national security and economic risks** if left unpatched.

VMware

Vulnerability

Severity: 85

Impact: 3

Seen: 4/2025

Blog:

VMW806040125

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: VMware has announced a critical security issue VMSA-2025-0006, a high-severity vulnerability affecting Aria Operations. This vulnerability, CVE-2025-22231, enables attackers with local access to escalate privileges to root level, potentially resulting in full system control. This may lead to unauthorized data access, service disruptions, or further network compromise. Important to note is that exploitation requires existing local administrative access. Targeted systems include VMware Aria Operations, Cloud Foundation, and Telco Cloud platforms. While patches are available, unpatched systems are still at risk. The flaw’s discovery was credited to researchers from MoyunSec Vlab.

VMware Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

🔒

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

🔒

A.I. Risk Score Predictions locked

Access Monitoring Plan

Underwriter Stats for VMware

Incidents vs Software Development Industry Average (This Year)

VMware has 1036.36% more incidents than the average of same-industry companies with at least one recorded incident.

Incidents vs All-Companies Average (This Year)

VMware has 681.25% more incidents than the average of all companies with at least one recorded incident.

Incident Types VMware vs Software Development Industry Avg (This Year)

VMware reported 5 incidents this year: 1 cyber attacks, 3 ransomware, 1 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.

Incident History — VMware (X = Date, Y = Severity)

VMware cyber incidents detection timeline including parent company and subsidiaries

VMware Company Subsidiaries

Security Report → Compare→

NiCE

nice.com

NiCE is transforming the world with AI that puts people first. Our purpose-built AI-powered platforms automate engagements into proactive, safe, intelligent actions, empowering individuals and organizations to innovate and act, from interaction to resolution. Trusted by organizations throughout 150

Security Report → Compare→

Read Article →

October 25, 2025 07:00 AM

Agenda Ransomware Actors Deploying Linux RAT on Windows Systems Targeting VMware Deployments

Cybersecurity researchers have uncovered a sophisticated ransomware campaign where Agenda group threat actors are deploying Linux-based...

Read Article →

Frequently Asked Questions

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.

VMware CyberSecurity History Information

Official Website of VMware

The official website of VMware is https://www.broadcom.com/info/vmware.

VMware’s AI-Generated Cybersecurity Score

According to Rankiteo, VMware’s AI-generated cybersecurity score is 279, reflecting their Critical security posture.

How many security badges does VMware’ have ?

According to Rankiteo, VMware currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Does VMware have SOC 2 Type 1 certification ?

According to Rankiteo, VMware is not certified under SOC 2 Type 1.

Does VMware have SOC 2 Type 2 certification ?

According to Rankiteo, VMware does not hold a SOC 2 Type 2 certification.

Does VMware comply with GDPR ?

According to Rankiteo, VMware is not listed as GDPR compliant.

Does VMware have PCI DSS certification ?

According to Rankiteo, VMware does not currently maintain PCI DSS compliance.

Does VMware comply with HIPAA ?

According to Rankiteo, VMware is not compliant with HIPAA regulations.

Does VMware have ISO 27001 certification ?

According to Rankiteo,VMware is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Industry Classification of VMware

VMware operates primarily in the Software Development industry.

Number of Employees at VMware

VMware employs approximately 13,658 people worldwide.

Subsidiaries Owned by VMware

VMware presently has no subsidiaries across any sectors.

VMware’s LinkedIn Followers

VMware’s official LinkedIn profile has approximately 2,032,204 followers.

NAICS Classification of VMware

VMware is classified under the NAICS code 5112, which corresponds to Software Publishers.

VMware’s Presence on Crunchbase

Yes, VMware has an official profile on Crunchbase, which can be accessed here: https://www.crunchbase.com/organization/vmware.

VMware’s Presence on LinkedIn

Yes, VMware maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/vmware.

Cybersecurity Incidents Involving VMware

As of November 27, 2025, Rankiteo reports that VMware has experienced 16 cybersecurity incidents.

Number of Peer and Competitor Companies

VMware has an estimated 26,597 peer or competitor companies worldwide.

What types of cybersecurity incidents have occurred at VMware ?

Incident Types: The types of cybersecurity incidents that have occurred include Ransomware, Breach, Vulnerability and Cyber Attack.

What was the total financial impact of these incidents on VMware ?

Total Financial Loss: The total financial loss from these incidents is estimated to be $0.

How does VMware detect and respond to cybersecurity incidents ?

Detection and Response: The company detects and responds to cybersecurity incidents through an network segmentation with ineffective segmentation, and enhanced monitoring with oversights in security monitoring, and remediation measures with patches available, and containment measures with block port 4011 on firewalls, containment measures with configure the irm_hostedserviceurl core setting with an empty value and restart the altiris inventory rule management service, and remediation measures with limit .net remoting access to localhost-only in upcoming releases, and law enforcement notified with yes, and enhanced monitoring with monitoring for risky logins and unauthorized account misuse, and and third party assistance with google threat intelligence group (gitg), third party assistance with mandiant, third party assistance with nviso (for windows variants), and containment measures with scanner script for *nix-based appliances (mandiant), containment measures with yara rule (g_apt_backdoor_brickstorm_3), and incident response plan activated with yes (broadcom patch release), and third party assistance with nviso (vulnerability reporting and poc), third party assistance with google mandiant (threat actor analysis), and containment measures with patch release for cve-2025-41244, containment measures with previous patches for cve-2025-22224, cve-2025-22225, cve-2025-22226 (march 2024), containment measures with nsx vulnerabilities patched (november 2024), and incident response plan activated with cisa's binding operational directive (bod) 22-01 enforcement, and third party assistance with broadcom (vmware) security patches, third party assistance with nviso (vulnerability research), third party assistance with google mandiant (threat actor analysis), and containment measures with patch application (mandated within 3 weeks for fceb agencies), containment measures with discontinuing use of vulnerable products if patches unavailable, and remediation measures with applying vendor-provided mitigations, remediation measures with enhanced monitoring for exploitation attempts, and communication strategy with cisa advisory to federal agencies and private sector, communication strategy with broadcom's public disclosure of exploitation, and enhanced monitoring with recommended for all organizations, and and third party assistance with nviso, third party assistance with google mandiant, and containment measures with patching vmware tools (12.4.9 for windows 32-bit, 12.5.4 for general; open-vm-tools for linux), containment measures with disabling sdmp if patching is not feasible, and remediation measures with applying security updates by november 20, 2025 (cisa deadline), remediation measures with monitoring for signs of exploitation, and communication strategy with cisa advisory via kev catalog, communication strategy with public disclosure by security researchers (e.g., bleepingcomputer, techradar), and enhanced monitoring with recommended for systems running vmware tools with sdmp, and communication strategy with public disclosure via the register; adp issued a statement clarifying limited impact and no ransom payment, and network segmentation with recommended for organizations using oracle e-business suite, and enhanced monitoring with recommended: review security logs for unauthorized access, deploy edr solutions, and and third party assistance with mandiant (google-owned cybersecurity firm), and containment measures with oracle security patches (cve-2025-61882, cve-2025-21884), and remediation measures with patch application for oracle ebs vulnerabilities, and communication strategy with oracle security alerts to customers, communication strategy with public disclosure via media..

Incident Details

Can you provide details on each incident ?

Incident : Data Breach

Exposure

Impact

Title: Symantec Data Breach

Description: Security firm Symantec was attacked by a hacker in February 2021, resulting in the extraction of data including passwords and a list of Symantec clients, including government agencies.

Date Detected: 2021-02-01

Type: Data Breach

Incident : Vulnerability Exploit

Exposure

Impact

Title: Symantec and Norton Vulnerabilities Identified by Tavis Ormandy

Type: Vulnerability Exploit

Attack Vector: Executable File

Vulnerability Exploited: File Decompression in Kernel

Motivation: Data Theft

Incident : Ransomware

Exposure

Impact

Title: SEXi Ransomware Attack on VMware ESXi Servers

Type: Ransomware

Attack Vector: Exploitation of vulnerabilities in VMware ESXi servers

Vulnerability Exploited: Critical vulnerabilities within the ESXi platform

Threat Actor: SEXi ransomware (rebranded as APT INC)

Motivation: Disruption of services and potential data leakage

Incident : Ransomware

Exposure

Impact

Title: Widespread Ransomware Attacks Exploiting VMware Vulnerabilities

Type: Ransomware

Attack Vector: Exploiting vulnerabilities in VMware virtualization products

Vulnerability Exploited: CVE-2025-22224CVE-2025-22225CVE-2025-22226

Motivation: Financial gain

Incident : Vulnerability

Exposure

Impact

Title: VMware VMSA-2025-0006 Privilege Escalation Vulnerability

Type: Vulnerability

Attack Vector: Local Access

Vulnerability Exploited: CVE-2025-22231

Motivation: Privilege Escalation

Incident : Ransomware

Exposure

Impact

Title: Exploitation of Kickidler for Ransomware Deployment

Type: Ransomware

Attack Vector: Poisoned ad on Google Ads networkTrojanized RVToolsSMOKEDHAM backdoor

Vulnerability Exploited: Kickidler employee monitoring tool

Threat Actor: QilinHunters International

Motivation: Obtain login credentials and deploy ransomware encryptors

Incident : Vulnerability

Exposure

Impact

Title: Critical Security Vulnerability in Broadcom’s Symantec Endpoint Management Suite

Description: A critical security vulnerability (CVE-2025-5333) has been discovered in Broadcom’s Symantec Endpoint Management Suite that enables unauthenticated remote code execution, posing significant risks to enterprise IT infrastructure.

Date Detected: May 2025

Type: Vulnerability

Attack Vector: Unauthenticated Remote Code Execution (RCE)

Vulnerability Exploited: CVE-2025-5333

Incident : Espionage

Exposure

Impact

Title: BRICKSTORM Backdoor Campaign Targeting US Legal, Tech, and SaaS Firms

Description: Chinese-aligned threat actors (UNC5221) deployed the BRICKSTORM backdoor in intrusion campaigns targeting US legal and tech firms, SaaS providers, and outsourcing companies since at least March 2025. The attacks exploited zero-day vulnerabilities in network appliances (e.g., VMware vCenter, ESXi hosts) to establish persistence, escalate privileges (via MFA bypass, credential harvesting, and VM cloning), and exfiltrate emails of key individuals. The backdoor communicates via WebSockets to a hardcoded C2 server and supports file manipulation, command execution, and SOCKS relaying. Dwell time averaged 393 days, often exceeding log retention periods.

Date Detected: 2024-04-01

Date Publicly Disclosed: 2025-09-24

Type: Espionage

Attack Vector: Exploitation of Zero-Day VulnerabilitiesBackdoor (BRICKSTORM)Credential HarvestingMFA BypassVM Cloning

Vulnerability Exploited: Zero-Day in Network Appliances (e.g., VMware vCenter, ESXi)Microsoft Entra ID Enterprise Applications (mail.read, full_access_as_app scopes)

Threat Actor: UNC5221Silk Typhoon (disputed as same group by some vendors)

Motivation: EspionageDevelopment of Zero-Day ExploitsPivoting to Downstream VictimsData Exfiltration (Emails of Key Individuals)

Incident : Privilege Escalation

Exposure

Impact

Title: Broadcom Patches High-Severity VMware Aria Operations and VMware Tools Privilege Escalation Vulnerability (CVE-2025-41244) Exploited by UNC5174

Description: Broadcom has patched a high-severity privilege escalation vulnerability (CVE-2025-41244) in its VMware Aria Operations and VMware Tools software, exploited in zero-day attacks since October 2024. The vulnerability allows unprivileged local attackers to escalate privileges to root-level code execution by staging a malicious binary in broadly-matched regex paths (e.g., /tmp/httpd). The attacks have been linked to the Chinese state-sponsored threat actor UNC5174, a contractor for China's Ministry of State Security (MSS). NVISO released a proof-of-concept exploit demonstrating the flaw's exploitation.

Date Detected: 2024-05-01

Date Publicly Disclosed: 2024-11-05

Type: Privilege Escalation

Attack Vector: LocalMalicious Binary StagingService Discovery Abuse

Vulnerability Exploited: CVE-2025-41244 (VMware Aria Operations and VMware Tools Privilege Escalation)

Threat Actor: UNC5174 (Chinese state-sponsored, linked to Ministry of State Security - MSS)

Motivation: EspionageFinancial Gain (selling network access)Cyber Warfare

Incident : Privilege Escalation

Exposure

Impact

Title: Exploitation of CVE-2025-41244 in VMware Aria Operations and VMware Tools by UNC5174

Description: CISA warned U.S. government agencies about active exploitation of CVE-2025-41244, a high-severity privilege escalation vulnerability in Broadcom's VMware Aria Operations and VMware Tools. The flaw, patched a month prior, allows local attackers with non-administrative privileges to escalate to root on a VM managed by Aria Operations with SDMP enabled. The Chinese state-sponsored threat actor UNC5174 has been exploiting this vulnerability since mid-October 2024, targeting U.S. defense contractors, UK government entities, and Asian institutions. CISA mandated federal agencies to patch within three weeks (by November 20, 2025) under BOD 22-01.

Date Detected: 2024-10-01T00:00:00Z

Date Publicly Disclosed: 2025-10-10T00:00:00Z

Type: Privilege Escalation

Attack Vector: Local AttackExploitation of Vulnerable Software (VMware Aria Operations/Tools)Credential-Based & Credential-Less Modes

Vulnerability Exploited: CVE-2025-41244

Threat Actor: UNC5174

Motivation: EspionageFinancial Gain (selling network access)State-Sponsored Activities

Incident : Privilege Escalation

Exposure

Impact

Title: Exploitation of CVE-2025-41244 in VMware Aria Operations and VMware Tools by UNC5174

Description: CISA added CVE-2025-41244 (a local privilege escalation vulnerability in VMware Aria Operations and VMware Tools with SDMP enabled) to its KEV catalog, mandating patching by November 20, 2025. The vulnerability was exploited by Chinese state-sponsored group UNC5174 for espionage targeting Western and Asian institutions, including US defense contractors, UK government agencies, and Asian organizations. The bug allows a local non-administrative actor to escalate privileges to root on a vulnerable VM. Proof-of-concept (POC) code was released by NVISO, and the vulnerability has been actively exploited since at least mid-October 2024.

Date Detected: 2024-10-01

Type: Privilege Escalation

Attack Vector: LocalPrivilege Escalation via VMware Tools with SDMP

Vulnerability Exploited: CVE-2025-41244

Threat Actor: UNC5174Houken (possibly linked)

Motivation: EspionageState-Sponsored Cyber Operations

Incident : ransomware

Exposure

Impact

Title: Ransomware Attack on Business Systems House (BSH) Leading to Broadcom Employee Data Theft

Description: A ransomware attack on Business Systems House (BSH), a Middle Eastern partner of payroll provider ADP, resulted in the theft of Broadcom employee data in September 2024. The data was leaked online in December 2024, but Broadcom was not informed until May 2025. The El Dorado ransomware group claimed responsibility. The breach occurred during Broadcom's transition away from ADP and BSH as payroll providers.

Date Detected: 2024-09

Date Publicly Disclosed: 2025-05

Type: ransomware

Attack Vector: third-party vendor (BSH, a regional partner of ADP)

Threat Actor: El Dorado ransomware group

Motivation: financial gaindata theft

Incident : data breach

Exposure

Impact

Title: Broadcom Middle Eastern Employees' Data Breach via Third-Party Ransomware Attack

Description: U.S. multinational semiconductor manufacturing company Broadcom had its Middle Eastern employees' data stolen following a September ransomware attack against **Business Systems House (BSH)**, a partner of its former payroll services provider **ADP**. The breach, claimed by the **El Dorado ransomware gang** (linked to **BlackLock**), occurred during Broadcom's transition to another payroll provider. Compromised data may include employees' birthdates, email addresses, phone numbers, home addresses, national ID numbers, national health insurance ID numbers, health insurance policy numbers, financial account numbers, salary details, and employment termination dates. ADP stated the incident impacted only a 'small subset' of clients in some Middle Eastern countries and confirmed no ransom was paid by ADP or BSH (to their knowledge).

Type: data breach

Attack Vector: supply chain attackthird-party compromise (payroll provider partner)

Threat Actor: El Dorado ransomware gangBlackLock operation

Motivation: financial gain (ransomware)

Incident : ransomware

Exposure

Impact

Title: Cl0p Ransomware Gang Claims Breach of Broadcom via Zero-Day in Oracle E-Business Suite

Description: The Cl0p ransomware gang has publicly claimed responsibility for breaching Broadcom, a leading semiconductor and infrastructure software company. The attackers allegedly exploited an unpatched zero-day vulnerability in Oracle E-Business Suite to gain initial access. The incident follows a pattern of Cl0p targeting high-value enterprise systems using zero-day and known vulnerabilities. Broadcom has not issued an official statement, and the claim remains unverified by independent security researchers. The vulnerability allows arbitrary code execution, persistent access, and lateral movement across corporate networks. Cl0p is known for combining zero-day exploitation with credential theft and data exfiltration before deploying ransomware.

Type: ransomware

Attack Vector: zero-day vulnerability in Oracle E-Business Suitearbitrary code executionlateral movementcredential theftdata exfiltration

Vulnerability Exploited: Unpatched zero-day vulnerability in Oracle E-Business Suite (arbitrary code execution)

Threat Actor: Cl0p ransomware gang

Motivation: financial gain (ransomware)data theft for extortiondisruption of high-value enterprise targets

Incident : Ransomware

Exposure

Impact

Title: Cl0p Exploits Zero-Day Vulnerabilities in Oracle E-Business Suite Leading to Massive Data Breaches

Description: The cybercriminal group Cl0p exploited two zero-day vulnerabilities (CVE-2025-61882 and CVE-2025-21884) in Oracle’s E-Business Suite (EBS), leading to data breaches in over 100 companies, including Broadcom, Estée Lauder, Mazda, and Canon. The group demanded significant ransom payments, threatening to leak or sell exfiltrated data if unpaid. Oracle issued security patches, but the attacks had already compromised sensitive corporate and customer data across multiple industries and geographies.

Date Detected: 2023-09-01

Date Publicly Disclosed: 2023-11-20

Type: Ransomware

Attack Vector: Zero-Day Exploit (CVE-2025-61882, CVE-2025-21884)Unauthenticated HTTP RequestsData Exfiltration

Threat Actor: Cl0p (Clop)

Motivation: Financial Gain (Ransomware Extortion)

What are the most common types of attacks the company has faced ?

Common Attack Types: The most common types of attacks the company has faced is Ransomware.

How does the company identify the attack vectors used in incidents ?

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Executable File, VMware virtualization products, Poisoned ad on Google Ads network, Port 4011, Social engineering, Zero-Day Exploits in Network Appliances, Exploitation of CVE-2025-41244 (privilege escalation via /tmp/httpd)Previous exploits: CVE-2023-46747 (F5 BIG-IP), CVE-2024-1709 (ConnectWise ScreenConnect), CVE-2025-31324 (NetWeaver Visual Composer), Exploitation of CVE-2025-41244 on vulnerable VMware systems, VMware Tools with SDMP enabledLocal privilege escalation on compromised VMs, unpatched zero-day vulnerability in Oracle E-Business Suite, Zero-day vulnerabilities in Oracle EBS (CVE-2025-61882 and CVE-2025-21884).

Impact of the Incidents

What was the impact of each incident ?

Incident : Data Breach SYM1336271222

Data Compromised: Passwords, List of symantec clients, Government agencies, List of clients using symantec's cloudsoc services, Account managers, Account numbers

Incident : Vulnerability Exploit SYM44121823

Systems Affected: Symantec Enterprise Products

Incident : Ransomware VMW000072224

Data Compromised: Potentially sensitive customer data

Systems Affected: VMware ESXi servers

Downtime: Significant disruptions to services

Incident : Ransomware VMW423032425

Data Compromised: Patient record systems, Transaction databases

Systems Affected: VMware virtualization productsPatient record systemsTransaction databases

Incident : Vulnerability VMW806040125

Data Compromised: Potential unauthorized data access

Systems Affected: VMware Aria OperationsCloud FoundationTelco Cloud platforms

Downtime: Potential service disruptions

Incident : Ransomware VMW222051225

Data Compromised: Login credentials of enterprise administrators

Systems Affected: VMware ESXi infrastructure

Incident : Vulnerability BRO809071525

Systems Affected: Symantec Endpoint Management Suite 8.6.x-8.8

Incident : Espionage VMW1132111092525

Data Compromised: Emails of key individuals, Files from email mailboxes

Systems Affected: VMware vCenter ServersESXi HostsNetwork AppliancesMicrosoft Entra ID Enterprise Applications

Operational Impact: Persistence via init.d/rc.local/systemdLateral Movement via Credential ReusePrivilege Escalation via Servlet Filter Injection

Brand Reputation Impact: Potential reputational damage due to espionage and data exfiltration

Incident : Privilege Escalation BRO4592445093025

Systems Affected: VMware Aria Operations (credential-based mode)VMware Tools (credential-less mode)

Operational Impact: Potential root-level code execution on vulnerable VMs, leading to full system compromise

Brand Reputation Impact: High (zero-day exploitation by state-sponsored actor, multiple high-profile vulnerabilities in 2024)

Incident : Privilege Escalation VMW3002130103125

Systems Affected: VMware Aria Operations (with SDMP enabled)VMware Tools on vulnerable VMs

Operational Impact: Potential root-level code execution on compromised VMsRisk of lateral movement within federal networks

Brand Reputation Impact: Potential reputational damage to U.S. federal agencies and Broadcom/VMware

Legal Liabilities: Non-compliance with BOD 22-01 for unpatched FCEB agencies

Incident : Privilege Escalation VMW2892328103125

Systems Affected: VMware Aria OperationsVMware Tools (with SDMP enabled)

Operational Impact: Privilege escalation to rootPotential unauthorized access to sensitive systems

Brand Reputation Impact: Potential reputational damage to VMwareTrust erosion in affected institutions

Incident : ransomware BRO3362533111725

Data Compromised: Broadcom employee data

Brand Reputation Impact: negative (ripples through tech and cybersecurity community)

Identity Theft Risk: potential (employee data exposed)

Incident : data breach BRO4981349111725

Data Compromised: Birthdates, Email addresses, Phone numbers, Home addresses, National id numbers, National health insurance id numbers, Health insurance policy numbers, Financial account numbers, Salary details, Employment termination dates

Brand Reputation Impact: potential reputational harm due to sensitive employee data exposure

Identity Theft Risk: high (due to exposure of PII and financial data)

Payment Information Risk: high (financial account numbers compromised)

Incident : ransomware BRO0893008112125

Systems Affected: Oracle E-Business Suitesupply chain operationsfinancial systemscustomer datamanufacturing operationsresearch data

Operational Impact: potential disruption of manufacturing operationssupply chain interruptionsglobal infrastructure risks

Brand Reputation Impact: high (targeting a $300B+ company)potential loss of trust in supply chain security

Legal Liabilities: potential regulatory compliance violations (e.g., data protection laws)

Incident : Ransomware BRO3105131112625

Systems Affected: Oracle E-Business Suite (EBS) versions 12.2.3–12.2.14

Operational Impact: Significant (data exfiltration, potential system compromise)

Brand Reputation Impact: High (public disclosure of breaches, ransom demands)

Identity Theft Risk: High (PII and sensitive corporate data exfiltrated)

What is the average financial loss per incident ?

Average Financial Loss: The average financial loss per incident is $0.00.

What types of data are most commonly compromised in incidents ?

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Passwords, List Of Symantec Clients, Government Agencies, List Of Clients Using Symantec'S Cloudsoc Services, Account Managers, Account Numbers, , Sensitive customer data, Patient Records, Transaction Data, , Login credentials, Credentials, Browser Data, Cookies, Sensitive Information, , Emails, Email Attachments/Files, , Employee Data, , Personally Identifiable Information (Pii), Financial Data, Employment Records, Health Insurance Details, , Potential: Corporate Data (Supply Chain, Financial, Customer), Intellectual Property (Research Data), , Corporate Data, Customer Data, Sensitive Business Information and .

Which entities were affected by each incident ?

Incident : Data Breach SYM1336271222

Entity Name: Symantec

Entity Type: Security Firm

Industry: Cybersecurity

Incident : Vulnerability Exploit SYM44121823

Entity Name: Symantec

Entity Type: Company

Industry: Cybersecurity

Incident : Ransomware VMW000072224

Entity Name: VMware

Entity Type: Organization

Industry: Technology

Incident : Ransomware VMW423032425

Entity Type: Enterprise

Industry: Healthcare, Financial

Incident : Vulnerability VMW806040125

Entity Name: VMware

Entity Type: Organization

Industry: Technology

Incident : Ransomware VMW222051225

Entity Type: Enterprises

Incident : Vulnerability BRO809071525

Entity Name: Broadcom

Entity Type: Organization

Industry: Technology

Incident : Espionage VMW1132111092525

Entity Type: Legal Firms, Tech Firms, SaaS Providers, Outsourcing Companies

Industry: Legal, Technology, Software-as-a-Service (SaaS), Outsourcing

Location: United States (primary target)

Incident : Espionage VMW1132111092525

Entity Type: European Organizations

Location: Europe

Incident : Privilege Escalation BRO4592445093025

Entity Name: Broadcom (VMware)

Entity Type: Technology Corporation

Industry: Software/Cloud Infrastructure

Location: United States (Global Operations)

Size: Large Enterprise

Incident : Privilege Escalation BRO4592445093025

Entity Name: U.S. Defense Contractors (via UNC5174 access sales)

Entity Type: Private/Government Contractors

Industry: Defense

Location: United States

Incident : Privilege Escalation BRO4592445093025

Entity Name: UK Government Entities (via UNC5174 access sales)

Entity Type: Government

Industry: Public Sector

Location: United Kingdom

Incident : Privilege Escalation BRO4592445093025

Entity Name: Asian Institutions (via UNC5174 access sales)

Entity Type: Government/Private

Industry: Multiple Sectors

Location: Asia

Incident : Privilege Escalation BRO4592445093025

Entity Name: U.S. and Canadian Institutions (via CVE-2024-1709 exploitation)

Entity Type: Multiple

Industry: Multiple Sectors

Location: United States, Canada

Customers Affected: Hundreds (per February 2024 attacks)

Incident : Privilege Escalation VMW3002130103125

Entity Name: U.S. Federal Civilian Executive Branch (FCEB) Agencies

Entity Type: Government

Industry: Public Sector

Location: United States

Incident : Privilege Escalation VMW3002130103125

Entity Name: U.S. Defense Contractors

Entity Type: Private Sector

Industry: Defense

Location: United States

Incident : Privilege Escalation VMW3002130103125

Entity Name: UK Government Entities

Entity Type: Government

Industry: Public Sector

Location: United Kingdom

Incident : Privilege Escalation VMW3002130103125

Entity Name: Asian Institutions (unspecified)

Location: Asia

Incident : Privilege Escalation VMW2892328103125

Entity Name: Federal Civilian Executive Branch (FCEB) Agencies (US)

Entity Type: Government

Industry: Public Sector

Location: United States

Incident : Privilege Escalation VMW2892328103125

Entity Name: US Defense Contractors

Entity Type: Private Sector

Industry: Defense

Location: United States

Incident : Privilege Escalation VMW2892328103125

Entity Name: UK Government Agencies

Entity Type: Government

Industry: Public Sector

Location: United Kingdom

Incident : Privilege Escalation VMW2892328103125

Entity Name: Asian Institutions (unspecified)

Entity Type: Government, Private Sector

Location: Asia

Incident : Privilege Escalation VMW2892328103125

Entity Name: French Government Agencies

Entity Type: Government

Industry: Public Sector

Location: France

Incident : Privilege Escalation VMW2892328103125

Entity Name: Commercial Entities (Telcos, Finance, Transportation)

Entity Type: Private Sector

Industry: Telecommunications, Financial Services, Transportation

Location: FranceGlobal

Incident : Privilege Escalation VMW2892328103125

Entity Name: VMware (Broadcom)

Entity Type: Private Sector

Industry: Technology

Location: Global

Size: Large Enterprise

Incident : ransomware BRO3362533111725

Entity Name: Broadcom Inc.

Entity Type: multinational corporation

Industry: semiconductor, infrastructure software

Location: global (HQ in San Jose, California, USA)

Incident : ransomware BRO3362533111725

Entity Name: Business Systems House (BSH)

Entity Type: regional payroll service provider

Industry: payroll services

Location: Middle East

Customers Affected: Broadcom employees (data compromised)

Incident : ransomware BRO3362533111725

Entity Name: ADP (Automatic Data Processing)

Entity Type: payroll services giant

Industry: HR and payroll services

Location: global (HQ in Roseland, New Jersey, USA)

Incident : data breach BRO4981349111725

Entity Name: Broadcom Inc.

Entity Type: public company

Industry: semiconductor manufacturing

Location: United States (global operations, breach impacted Middle Eastern employees)

Size: large (multinational)

Incident : data breach BRO4981349111725

Entity Name: Business Systems House (BSH)

Entity Type: private company (ADP partner)

Industry: payroll services

Location: Middle East

Customers Affected: small subset of clients (including Broadcom)

Incident : data breach BRO4981349111725

Entity Name: ADP (Automatic Data Processing)

Entity Name: Greater Cleveland RTA

Entity Type: Government Agency

Industry: Transportation

Location: United States

Entity Name: Treet Corp

Entity Type: Corporation

Industry: Manufacturing

Incident : Ransomware BRO3105131112625

Entity Name: University of Phoenix

Entity Type: Educational Institution

Industry: Education

Location: United States

Size: Large

Incident : Ransomware BRO3105131112625

Entity Name: L&L Products

Entity Type: Corporation

Industry: Automotive/Manufacturing

Location: United States

Size: Mid-Large

Incident : Ransomware BRO3105131112625

Entity Name: Worley

Entity Type: Corporation

Industry: Engineering/Consulting

Location: Australia

Entity Name: Greenball

Entity Type: Corporation

Industry: Manufacturing

Incident : Ransomware BRO3105131112625

Entity Name: Sumitomo Chemical

Entity Type: Corporation

Industry: Chemicals

Location: Japan

Size: Large

Incident : Ransomware BRO3105131112625

Entity Name: Aljomaih Automotive Company (AAC)

Entity Type: Corporation

Industry: Automotive

Location: Saudi Arabia

Size: Large

Response to the Incidents

What measures were taken in response to each incident ?

Incident : Ransomware VMW423032425

Network Segmentation: Ineffective segmentation

Enhanced Monitoring: Oversights in security monitoring

Incident : Vulnerability VMW806040125

Remediation Measures: Patches available

Incident : Vulnerability BRO809071525

Containment Measures: Block port 4011 on firewallsConfigure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service

Remediation Measures: Limit .NET Remoting access to localhost-only in upcoming releases

Incident : Espionage VMW1132111092525

Incident Response Plan Activated: True

Third Party Assistance: Google Threat Intelligence Group (Gitg), Mandiant, Nviso (For Windows Variants).

Containment Measures: Scanner Script for *nix-based Appliances (Mandiant)YARA Rule (G_APT_Backdoor_BRICKSTORM_3)

Incident : Privilege Escalation BRO4592445093025

Incident Response Plan Activated: Yes (Broadcom patch release)

Third Party Assistance: Nviso (Vulnerability Reporting And Poc), Google Mandiant (Threat Actor Analysis).

Containment Measures: Patch release for CVE-2025-41244Previous patches for CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 (March 2024)NSX vulnerabilities patched (November 2024)

Incident : Privilege Escalation VMW3002130103125

Incident Response Plan Activated: ["CISA's Binding Operational Directive (BOD) 22-01 enforcement"]

Third Party Assistance: Broadcom (Vmware) Security Patches, Nviso (Vulnerability Research), Google Mandiant (Threat Actor Analysis).

Containment Measures: Patch application (mandated within 3 weeks for FCEB agencies)Discontinuing use of vulnerable products if patches unavailable

Remediation Measures: Applying vendor-provided mitigationsEnhanced monitoring for exploitation attempts

Communication Strategy: CISA advisory to federal agencies and private sectorBroadcom's public disclosure of exploitation

Enhanced Monitoring: Recommended for all organizations

Incident : Privilege Escalation VMW2892328103125

Incident Response Plan Activated: True

Third Party Assistance: Nviso, Google Mandiant.

Containment Measures: Patching VMware Tools (12.4.9 for Windows 32-bit, 12.5.4 for general; open-vm-tools for Linux)Disabling SDMP if patching is not feasible

Remediation Measures: Applying security updates by November 20, 2025 (CISA deadline)Monitoring for signs of exploitation

Communication Strategy: CISA advisory via KEV catalogPublic disclosure by security researchers (e.g., BleepingComputer, TechRadar)

Enhanced Monitoring: Recommended for systems running VMware Tools with SDMP

Incident : data breach BRO4981349111725

Communication Strategy: public disclosure via The Register; ADP issued a statement clarifying limited impact and no ransom payment

Incident : ransomware BRO0893008112125

Network Segmentation: ['recommended for organizations using Oracle E-Business Suite']

Enhanced Monitoring: recommended: review security logs for unauthorized access, deploy EDR solutions

Incident : Ransomware BRO3105131112625

Incident Response Plan Activated: True

Third Party Assistance: Mandiant (Google-Owned Cybersecurity Firm).

Containment Measures: Oracle security patches (CVE-2025-61882, CVE-2025-21884)

Remediation Measures: Patch application for Oracle EBS vulnerabilities

Communication Strategy: Oracle security alerts to customersPublic disclosure via media

What is the company's incident response plan?

Incident Response Plan: The company's incident response plan is described as Yes (Broadcom patch release), CISA's Binding Operational Directive (BOD) 22-01 enforcement, , , .

How does the company involve third-party assistance in incident response ?

Third-Party Assistance: The company involves third-party assistance in incident response through Google Threat Intelligence Group (GITG), Mandiant, NVISO (for Windows variants), , NVISO (vulnerability reporting and PoC), Google Mandiant (threat actor analysis), , Broadcom (VMware) security patches, NVISO (vulnerability research), Google Mandiant (threat actor analysis), , NVISO, Google Mandiant, , Mandiant (Google-owned cybersecurity firm), .

Data Breach Information

What type of data was compromised in each breach ?

Incident : Data Breach SYM1336271222

Type of Data Compromised: Passwords, List of symantec clients, Government agencies, List of clients using symantec's cloudsoc services, Account managers, Account numbers

Incident : Ransomware VMW000072224

Type of Data Compromised: Sensitive customer data

Sensitivity of Data: High

Incident : Ransomware VMW423032425

Type of Data Compromised: Patient records, Transaction data

Data Encryption: Widespread encryption

Incident : Ransomware VMW222051225

Type of Data Compromised: Login credentials

Sensitivity of Data: High

Incident : Espionage VMW1132111092525

Type of Data Compromised: Emails, Email attachments/files

Sensitivity of Data: High (targeted key individuals within organizations)

Incident : Privilege Escalation VMW2892328103125

Data Exfiltration: Likely (espionage-focused)No specific details provided

Incident : ransomware BRO3362533111725

Type of Data Compromised: Employee data

Sensitivity of Data: high (employee records)

Data Exfiltration: yes (leaked online in December 2024)

Personally Identifiable Information: likely (employee data)

Incident : data breach BRO4981349111725

Type of Data Compromised: Personally identifiable information (pii), Financial data, Employment records, Health insurance details

Sensitivity of Data: high (includes national IDs, financial accounts, and health insurance details)

Incident : ransomware BRO0893008112125

Type of Data Compromised: Potential: corporate data (supply chain, financial, customer), Intellectual property (research data)

Sensitivity of Data: high (enterprise resource planning data)potentially confidential (manufacturing, R&D)

Data Exfiltration: claimed by Cl0p (typical tactic before ransomware deployment)

Incident : Ransomware BRO3105131112625

Type of Data Compromised: Corporate data, Customer data, Sensitive business information

Sensitivity of Data: High

What measures does the company take to prevent data exfiltration ?

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Patches available, Limit .NET Remoting access to localhost-only in upcoming releases, , Applying vendor-provided mitigations, Enhanced monitoring for exploitation attempts, , Applying security updates by November 20, 2025 (CISA deadline), Monitoring for signs of exploitation, , Patch application for Oracle EBS vulnerabilities, .

How does the company handle incidents involving personally identifiable information (PII) ?

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by block port 4011 on firewalls, configure the irm_hostedserviceurl core setting with an empty value and restart the altiris inventory rule management service, , scanner script for *nix-based appliances (mandiant), yara rule (g_apt_backdoor_brickstorm_3), , patch release for cve-2025-41244, previous patches for cve-2025-22224, cve-2025-22225, cve-2025-22226 (march 2024), nsx vulnerabilities patched (november 2024), , patch application (mandated within 3 weeks for fceb agencies), discontinuing use of vulnerable products if patches unavailable, , patching vmware tools (12.4.9 for windows 32-bit, 12.5.4 for general; open-vm-tools for linux), disabling sdmp if patching is not feasible, , oracle security patches (cve-2025-61882, cve-2025-21884) and .

Ransomware Information

Was ransomware involved in any of the incidents ?

Incident : Ransomware VMW000072224

Ransomware Strain: SEXi (rebranded as APT INC)

Incident : Ransomware VMW423032425

Ransom Demanded: ['$2 million', '$5 million']

Data Encryption: Widespread encryption

Incident : Ransomware VMW222051225

Data Encryption: VMDK virtual hard drives

Incident : ransomware BRO3362533111725

Ransomware Strain: El Dorado

Data Exfiltration: yes

Incident : data breach BRO4981349111725

Ransomware Strain: El Dorado (linked to BlackLock)

Data Exfiltration: True

Incident : ransomware BRO0893008112125

Ransomware Strain: Cl0p

Data Encryption: ['likely (standard Cl0p tactic post-exfiltration)']

Data Exfiltration: ['claimed (pre-ransomware deployment)']

Incident : Ransomware BRO3105131112625

Ransom Demanded: True

Ransomware Strain: Cl0p (Clop)

Data Exfiltration: True

Regulatory Compliance

Were there any regulatory violations and fines imposed for each incident ?

Incident : Privilege Escalation VMW3002130103125

Regulations Violated: Binding Operational Directive (BOD) 22-01 (if unpatched),

Regulatory Notifications: CISA's Known Exploited Vulnerabilities (KEV) catalog inclusion

Incident : Privilege Escalation VMW2892328103125

Regulatory Notifications: CISA KEV catalog inclusion (mandatory patching deadline: November 20, 2025)

Lessons Learned and Recommendations

What lessons were learned from each incident ?

Incident : Ransomware VMW000072224

Lessons Learned: Importance of robust security measures to prevent such incidents.

Incident : Espionage VMW1132111092525

Lessons Learned: Threat actors leveraged zero-day vulnerabilities in network appliances lacking EDR support (e.g., VMware vCenter)., Dwell time (avg. 393 days) often exceeded log retention, complicating forensics., BRICKSTORM's self-monitoring (Watcher function) and WebSocket C2 evaded traditional detection., Lateral movement relied on credential reuse from vaults (e.g., Delinea Secret Server) and automated secret stealer tools., Microsoft Entra ID scopes (mail.read, full_access_as_app) were exploited for email access.

Incident : Privilege Escalation BRO4592445093025

Lessons Learned: 1. State-sponsored actors like UNC5174 are increasingly exploiting zero-day vulnerabilities in enterprise software (VMware, F5 BIG-IP, ConnectWise, SAP) for espionage and financial gain. 2. Privilege escalation vulnerabilities in widely used tools (e.g., VMware Aria Operations) can lead to full system compromise if left unpatched. 3. Collaboration with threat intelligence firms (NVISO, Mandiant, Microsoft) is critical for timely detection and mitigation. 4. Regular patching of high-severity vulnerabilities reported by entities like NSA and Microsoft Threat Intelligence is essential to prevent exploitation.

Incident : Privilege Escalation VMW3002130103125

Lessons Learned: Critical importance of timely patching for known exploited vulnerabilities (KEVs), State-sponsored actors leverage privilege escalation flaws for persistent access, Need for cross-sector collaboration (e.g., NVISO, Mandiant, CISA) in threat intelligence sharing

Incident : Privilege Escalation VMW2892328103125

Lessons Learned: State-sponsored actors leverage zero-day vulnerabilities for long-term espionage campaigns., Timely patching is critical to mitigate exploitation, especially for vulnerabilities added to CISA's KEV catalog., Collaboration between security researchers (e.g., NVISO, Mandiant) and government agencies (e.g., CISA) is essential for threat intelligence sharing., Proof-of-concept (POC) code releases can accelerate both defensive and offensive operations.

Incident : ransomware BRO0893008112125

Lessons Learned: Zero-day vulnerabilities in enterprise software (e.g., Oracle E-Business Suite) pose severe risks due to lack of patches at exploitation time., High-value targets (e.g., semiconductor manufacturers) are prioritized by ransomware groups like Cl0p for maximum impact., Proactive measures (e.g., network segmentation, EDR, threat intelligence monitoring) are critical for mitigating zero-day risks., Supply chain and ERP systems are attractive targets due to their central role in business operations.

Incident : Ransomware BRO3105131112625

Lessons Learned: Supplier vulnerabilities in enterprise software (e.g., Oracle EBS) can cascade into large-scale breaches across industries. Proactive patch management and supply chain risk monitoring (e.g., via SCRM platforms like Z2Data) are critical to mitigating third-party risks. Cl0p’s delayed data leak strategy highlights the importance of rapid incident response to prevent public exposure of sensitive data.

What recommendations were made to prevent future incidents ?

Incident : Ransomware VMW423032425

Recommendations: Urgent patch application, Heightened vigilanceUrgent patch application, Heightened vigilance

Incident : Vulnerability BRO809071525

Recommendations: Block port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releasesBlock port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releasesBlock port 4011 on firewalls, Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Limit .NET Remoting access to localhost-only in upcoming releases

Incident : Espionage VMW1132111092525

Recommendations: Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.

Incident : Privilege Escalation BRO4592445093025

Recommendations: Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.

Incident : Privilege Escalation VMW3002130103125

Recommendations: Immediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMsImmediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMsImmediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMsImmediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMsImmediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMs

Incident : Privilege Escalation VMW2892328103125

Recommendations: Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.

Incident : ransomware BRO0893008112125

Recommendations: Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.

Incident : Ransomware BRO3105131112625

Recommendations: Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.

What are the key lessons learned from past incidents ?

Key Lessons Learned: The key lessons learned from past incidents are Importance of robust security measures to prevent such incidents.Threat actors leveraged zero-day vulnerabilities in network appliances lacking EDR support (e.g., VMware vCenter).,Dwell time (avg. 393 days) often exceeded log retention, complicating forensics.,BRICKSTORM's self-monitoring (Watcher function) and WebSocket C2 evaded traditional detection.,Lateral movement relied on credential reuse from vaults (e.g., Delinea Secret Server) and automated secret stealer tools.,Microsoft Entra ID scopes (mail.read, full_access_as_app) were exploited for email access.1. State-sponsored actors like UNC5174 are increasingly exploiting zero-day vulnerabilities in enterprise software (VMware, F5 BIG-IP, ConnectWise, SAP) for espionage and financial gain. 2. Privilege escalation vulnerabilities in widely used tools (e.g., VMware Aria Operations) can lead to full system compromise if left unpatched. 3. Collaboration with threat intelligence firms (NVISO, Mandiant, Microsoft) is critical for timely detection and mitigation. 4. Regular patching of high-severity vulnerabilities reported by entities like NSA and Microsoft Threat Intelligence is essential to prevent exploitation.Critical importance of timely patching for known exploited vulnerabilities (KEVs),State-sponsored actors leverage privilege escalation flaws for persistent access,Need for cross-sector collaboration (e.g., NVISO, Mandiant, CISA) in threat intelligence sharingState-sponsored actors leverage zero-day vulnerabilities for long-term espionage campaigns.,Timely patching is critical to mitigate exploitation, especially for vulnerabilities added to CISA's KEV catalog.,Collaboration between security researchers (e.g., NVISO, Mandiant) and government agencies (e.g., CISA) is essential for threat intelligence sharing.,Proof-of-concept (POC) code releases can accelerate both defensive and offensive operations.Zero-day vulnerabilities in enterprise software (e.g., Oracle E-Business Suite) pose severe risks due to lack of patches at exploitation time.,High-value targets (e.g., semiconductor manufacturers) are prioritized by ransomware groups like Cl0p for maximum impact.,Proactive measures (e.g., network segmentation, EDR, threat intelligence monitoring) are critical for mitigating zero-day risks.,Supply chain and ERP systems are attractive targets due to their central role in business operations.Supplier vulnerabilities in enterprise software (e.g., Oracle EBS) can cascade into large-scale breaches across industries. Proactive patch management and supply chain risk monitoring (e.g., via SCRM platforms like Z2Data) are critical to mitigating third-party risks. Cl0p’s delayed data leak strategy highlights the importance of rapid incident response to prevent public exposure of sensitive data.

What recommendations has the company implemented to improve cybersecurity ?

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Deploy application controls to manage software execution, Heightened vigilance, Urgent patch application, Enhance monitoring for risky logins and unauthorized account misuse, Implement phishing-resistant multifactor authentication and Maintain offline backups stored separately from source systems.

References

Where can I find more information about each incident ?

Incident : Vulnerability VMW806040125

Source: VMware

Incident : Vulnerability BRO809071525

Source: Broadcom PSIRT

Incident : Vulnerability BRO809071525

Source: LRQA security researchers

Incident : Espionage VMW1132111092525

Source: Google Threat Intelligence Group (GITG)

Date Accessed: 2025-09-24

Incident : Espionage VMW1132111092525

Source: Google Mandiant BRICKSTORM Scanner Script

Incident : Espionage VMW1132111092525

Source: NVISO Report on BRICKSTORM Windows Variants

Date Accessed: 2025-04-01

Incident : Espionage VMW1132111092525

Source: Google Report on BRICKSTORM (April 2024)

Date Accessed: 2024-04-01

Incident : Privilege Escalation BRO4592445093025

Source: BleepingComputer

Date Accessed: 2024-11-05

Incident : Privilege Escalation BRO4592445093025

Source: NVISO Research (Maxime Thiebaut)

Date Accessed: 2024-11-04

Incident : Privilege Escalation BRO4592445093025

Source: Google Mandiant (UNC5174 Analysis)

Incident : Privilege Escalation BRO4592445093025

Source: Broadcom Security Advisory for CVE-2025-41244

Date Accessed: 2024-11-05

Incident : Privilege Escalation BRO4592445093025

Source: Microsoft Threat Intelligence (VMware Zero-Days, March 2024)

Incident : Privilege Escalation VMW3002130103125

Source: CISA Advisory on CVE-2025-41244

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Date Accessed: 2025-10-10

Incident : Privilege Escalation VMW3002130103125

Source: NVISO Research (Maxime Thiebaut) - Proof of Concept

Date Accessed: 2024-10-01

Incident : Privilege Escalation VMW3002130103125

Source: Google Mandiant - UNC5174 Threat Actor Profile

Date Accessed: 2024-12-01

Incident : Privilege Escalation VMW3002130103125

Source: Broadcom Security Advisory for CVE-2025-41244

Date Accessed: 2025-09-10

Incident : Privilege Escalation VMW2892328103125

Source: CISA Known Exploited Vulnerabilities (KEV) Catalog

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Incident : Privilege Escalation VMW2892328103125

Source: BleepingComputer

URL: https://www.bleepingcomputer.com

Incident : Privilege Escalation VMW2892328103125

Source: TechRadar

URL: https://www.techradar.com

Incident : Privilege Escalation VMW2892328103125

Source: NVISO (Proof-of-Concept Release)

Incident : Privilege Escalation VMW2892328103125

Source: Google Mandiant (UNC5174 Analysis)

Incident : ransomware BRO3362533111725

Source: The Register

Incident : data breach BRO4981349111725

Source: The Register

Incident : ransomware BRO0893008112125

Source: GBHackers (GBH)

Incident : Ransomware BRO3105131112625

Source: U.S. Cybersecurity and Infrastructure Security Agency (CISA)

Incident : Ransomware BRO3105131112625

Source: UK National Cyber Security Centre (NCSC)

Incident : Ransomware BRO3105131112625

Source: Mandiant (Google-owned cybersecurity firm)

Incident : Ransomware BRO3105131112625

Source: Oracle Security Alerts (CVE-2025-61882, CVE-2025-21884)

Incident : Ransomware BRO3105131112625

Source: Z2Data Supplier Risk Analysis

URL: https://www.z2data.com

Where can stakeholders find additional resources on cybersecurity best practices ?

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: VMware, and Source: Broadcom PSIRT, and Source: LRQA security researchers, and Source: Federal Bureau of Investigation (FBI)Date Accessed: July 29, 2025, and Source: Cybersecurity and Infrastructure Security Agency (CISA)Date Accessed: July 29, 2025, and Source: Royal Canadian Mounted Police (RCMP)Date Accessed: July 29, 2025, and Source: Australian Signals Directorate’s Australian Cyber Security Centre (ACSC)Date Accessed: July 29, 2025, and Source: Australian Federal Police (AFP)Date Accessed: July 29, 2025, and Source: Canadian Centre for Cyber Security (CCCS)Date Accessed: July 29, 2025, and Source: United Kingdom’s National Cyber Security Centre (NCSC-UK)Date Accessed: July 29, 2025, and Source: Google Threat Intelligence Group (GITG)Date Accessed: 2025-09-24, and Source: Google Mandiant BRICKSTORM Scanner Script, and Source: NVISO Report on BRICKSTORM Windows VariantsDate Accessed: 2025-04-01, and Source: Google Report on BRICKSTORM (April 2024)Date Accessed: 2024-04-01, and Source: BleepingComputerDate Accessed: 2024-11-05, and Source: NVISO Research (Maxime Thiebaut)Date Accessed: 2024-11-04, and Source: Google Mandiant (UNC5174 Analysis), and Source: Broadcom Security Advisory for CVE-2025-41244Date Accessed: 2024-11-05, and Source: Microsoft Threat Intelligence (VMware Zero-Days, March 2024), and Source: CISA Advisory on CVE-2025-41244Url: https://www.cisa.gov/known-exploited-vulnerabilities-catalogDate Accessed: 2025-10-10, and Source: NVISO Research (Maxime Thiebaut) - Proof of ConceptDate Accessed: 2024-10-01, and Source: Google Mandiant - UNC5174 Threat Actor ProfileDate Accessed: 2024-12-01, and Source: Broadcom Security Advisory for CVE-2025-41244Date Accessed: 2025-09-10, and Source: CISA Known Exploited Vulnerabilities (KEV) CatalogUrl: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, and Source: BleepingComputerUrl: https://www.bleepingcomputer.com, and Source: TechRadarUrl: https://www.techradar.com, and Source: NVISO (Proof-of-Concept Release), and Source: Google Mandiant (UNC5174 Analysis), and Source: The Register, and Source: The Register, and Source: GBHackers (GBH), and Source: U.S. Cybersecurity and Infrastructure Security Agency (CISA), and Source: UK National Cyber Security Centre (NCSC), and Source: Mandiant (Google-owned cybersecurity firm), and Source: Oracle Security Alerts (CVE-2025-61882, CVE-2025-21884), and Source: Z2Data Supplier Risk AnalysisUrl: https://www.z2data.com.

Investigation Status

What is the current status of the investigation for each incident ?

Incident : Espionage VMW1132111092525

Investigation Status: Ongoing (as of September 2025)

Incident : Privilege Escalation BRO4592445093025

Investigation Status: Ongoing (patch released; threat actor activity under monitoring)

Incident : Privilege Escalation VMW3002130103125

Investigation Status: Ongoing (active exploitation confirmed; patching mandated)

Incident : Privilege Escalation VMW2892328103125

Investigation Status: Ongoing (active exploitation reported as of late 2024)

Incident : ransomware BRO3362533111725

Investigation Status: disclosed (May 2025)

Incident : data breach BRO4981349111725

Investigation Status: ongoing (limited details disclosed)

Incident : ransomware BRO0893008112125

Investigation Status: unverified (claimed by Cl0p, no official statement from Broadcom; independent verification pending)

Incident : Ransomware BRO3105131112625

Investigation Status: Ongoing (Cl0p’s data leak timeline suggests delayed public exposure)

How does the company communicate the status of incident investigations to stakeholders ?

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Cisa Advisory To Federal Agencies And Private Sector, Broadcom'S Public Disclosure Of Exploitation, Cisa Advisory Via Kev Catalog, Public Disclosure By Security Researchers (E.G., Bleepingcomputer, Techradar), public disclosure via The Register; ADP issued a statement clarifying limited impact and no ransom payment, Oracle Security Alerts To Customers and Public Disclosure Via Media.

Stakeholder and Customer Advisories

Were there any advisories issued to stakeholders or customers for each incident ?

Incident : Privilege Escalation BRO4592445093025

Customer Advisories: Broadcom urged customers to apply patches immediately; no detailed advisory provided in the article.

Incident : Privilege Escalation VMW3002130103125

Stakeholder Advisories: Cisa Alert To Fceb Agencies, Broadcom Customer Notifications.

Customer Advisories: Urgent patching recommendations for VMware Aria Operations/Tools users

Incident : Privilege Escalation VMW2892328103125

Stakeholder Advisories: Cisa Kev Advisory, Vmware Security Bulletin (Implied).

Customer Advisories: VMware patch notificationsSecurity researcher disclosures (e.g., NVISO, Mandiant)

Incident : Ransomware BRO3105131112625

Stakeholder Advisories: Oracle Security Alerts Urging Immediate Patching, Mandiant’S Analysis Of Cl0P’S Modus Operandi.

Customer Advisories: Companies advised to monitor for data leaks on Cl0p’s blog or dark web marketplaces

What advisories does the company provide to stakeholders and customers following an incident ?

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Broadcom urged customers to apply patches immediately; no detailed advisory provided in the article., Cisa Alert To Fceb Agencies, Broadcom Customer Notifications, Urgent Patching Recommendations For Vmware Aria Operations/Tools Users, , Cisa Kev Advisory, Vmware Security Bulletin (Implied), Vmware Patch Notifications, Security Researcher Disclosures (E.G., Nviso, Mandiant), , Oracle Security Alerts Urging Immediate Patching, Mandiant’S Analysis Of Cl0P’S Modus Operandi, Companies Advised To Monitor For Data Leaks On Cl0P’S Blog Or Dark Web Marketplaces and .

Initial Access Broker

How did the initial access broker gain entry for each incident ?

Incident : Vulnerability Exploit SYM44121823

Entry Point: Executable File

Incident : Ransomware VMW423032425

Entry Point: VMware virtualization products

High Value Targets: Healthcare And Financial Sectors,

Data Sold on Dark Web: Healthcare And Financial Sectors,

Incident : Ransomware VMW222051225

Entry Point: Poisoned ad on Google Ads network

Backdoors Established: SMOKEDHAM

High Value Targets: Enterprise administrators

Data Sold on Dark Web: Enterprise administrators

Incident : Vulnerability BRO809071525

Entry Point: Port 4011

Incident : Espionage VMW1132111092525

Entry Point: Zero-Day Exploits In Network Appliances,

Backdoors Established: ['BRICKSTORM (Go-based backdoor)']

High Value Targets: Emails Of Key Individuals, Delinea Secret Server, Microsoft Entra Id Enterprise Applications,

Data Sold on Dark Web: Emails Of Key Individuals, Delinea Secret Server, Microsoft Entra Id Enterprise Applications,

Incident : Privilege Escalation BRO4592445093025

Entry Point: Exploitation Of Cve-2025-41244 (Privilege Escalation Via /Tmp/Httpd), Previous Exploits: Cve-2023-46747 (F5 Big-Ip), Cve-2024-1709 (Connectwise Screenconnect), Cve-2025-31324 (Netweaver Visual Composer),

Backdoors Established: Likely (based on UNC5174's history of selling network access)

High Value Targets: U.S. Defense Contractors, Uk Government Entities, Asian Institutions, Critical Infrastructure (Uk/Us Via Sap Netweaver Attacks),

Data Sold on Dark Web: U.S. Defense Contractors, Uk Government Entities, Asian Institutions, Critical Infrastructure (Uk/Us Via Sap Netweaver Attacks),

Incident : Privilege Escalation VMW3002130103125

Entry Point: Exploitation Of Cve-2025-41244 On Vulnerable Vmware Systems,

Reconnaissance Period: ['Since at least mid-October 2024 (per NVISO)']

High Value Targets: U.S. Defense Contractors, Uk Government Networks, Asian Institutions,

Data Sold on Dark Web: U.S. Defense Contractors, Uk Government Networks, Asian Institutions,

Incident : Privilege Escalation VMW2892328103125

Entry Point: Vmware Tools With Sdmp Enabled, Local Privilege Escalation On Compromised Vms,

Reconnaissance Period: ['At least since mid-October 2024 (per NVISO)', 'Potentially longer (up to a year, per researchers)']

High Value Targets: Us Defense Contractors, Uk Government Agencies, French Government Agencies, Asian Institutions,

Data Sold on Dark Web: Us Defense Contractors, Uk Government Agencies, French Government Agencies, Asian Institutions,

Incident : ransomware BRO3362533111725

High Value Targets: Broadcom Employee Data,

Data Sold on Dark Web: Broadcom Employee Data,

Incident : data breach BRO4981349111725

High Value Targets: employee PII and financial data

Data Sold on Dark Web: employee PII and financial data

Incident : ransomware BRO0893008112125

Entry Point: unpatched zero-day vulnerability in Oracle E-Business Suite

Backdoors Established: ['likely (Cl0p tactic for persistence)']

High Value Targets: Broadcom'S Manufacturing Operations, Research Data, Customer Information, Supply Chain Systems,

Data Sold on Dark Web: Broadcom'S Manufacturing Operations, Research Data, Customer Information, Supply Chain Systems,

Incident : Ransomware BRO3105131112625

Entry Point: Zero-Day Vulnerabilities In Oracle Ebs (Cve-2025-61882, Cve-2025-21884),

Reconnaissance Period: Since late September 2023 (pre-exploitation activity)

High Value Targets: Fortune 500 Companies (E.G., Broadcom, Estée Lauder), Multinational Corporations With Oracle Ebs Dependencies,

Data Sold on Dark Web: Fortune 500 Companies (E.G., Broadcom, Estée Lauder), Multinational Corporations With Oracle Ebs Dependencies,

Post-Incident Analysis

What were the root causes and corrective actions taken for each incident ?

Incident : Ransomware VMW423032425

Root Causes: Oversights In Security Monitoring, Ineffective Segmentation, Delay In Implementing Available Patches,

Incident : Ransomware VMW222051225

Root Causes: Exploitation of Kickidler tool

Incident : Vulnerability BRO809071525

Root Causes: Insecure deserialization of .NET objects through the BinaryServerFormatterSinkProvider with TypeFilterLevel set to Full

Corrective Actions: Block Port 4011 On Firewalls, Configure The Irm Hostedserviceurl Core Setting With An Empty Value And Restart The Altiris Inventory Rule Management Service, Limit .Net Remoting Access To Localhost-Only In Upcoming Releases,

Incident : Espionage VMW1132111092525

Root Causes: Exploitation Of Unpatched Zero-Day Vulnerabilities In Network Appliances., Lack Of Edr Support On Targeted Systems (E.G., Vmware Vcenter)., Insufficient Log Retention (Dwell Time Exceeded Retention Periods)., Overprivileged Microsoft Entra Id Applications (Mail.Read, Full Access As App)., Credential Harvesting Via Http Basic Auth And Mfa Bypass Techniques.,

Corrective Actions: Deploy Mandiant’S Scanner Script For Brickstorm Detection., Audit And Restrict Entra Id Application Permissions., Enhance Monitoring For Websocket-Based C2 Traffic (E.G., Wss://Opra1.Oprawh.Workers[.]Dev)., Implement Network Segmentation To Isolate Vmware Environments., Extend Log Retention Policies To At Least 1 Year (To Cover 393-Day Dwell Time).,

Incident : Privilege Escalation BRO4592445093025

Root Causes: Privilege Escalation Vulnerability In Vmware Service Discovery Mechanism (Broad Regex Path Matching)., Insufficient Validation Of Unprivileged User Processes Opening Listening Sockets., Delayed Public Disclosure Of In-The-Wild Exploitation (Attacks Began In October 2024; Patch/Report In November 2024)., Reuse Of Exploit Techniques Across Multiple Vulnerabilities (E.G., Cve-2023-46747, Cve-2024-1709) By Unc5174.,

Corrective Actions: Broadcom Released Patches For Cve-2025-41244 And Related Vmware Nsx Vulnerabilities., Nviso Published Poc To Aid Detection And Mitigation., Organizations Advised To Audit Vmware Environments For Signs Of Exploitation (E.G., Suspicious /Tmp/Httpd Binaries)., Enhanced Monitoring For Unc5174 Ttps (Tactics, Techniques, Procedures) Across Enterprise Software.,

Incident : Privilege Escalation VMW3002130103125

Root Causes: Delayed Patching Of Known Critical Vulnerability (Cve-2025-41244), Insufficient Privilege Separation In Vmware Tools/Aria Operations, State-Sponsored Actor (Unc5174) Leveraging Zero-Day Exploitation Chain,

Corrective Actions: Enforce Bod 22-01 Compliance For Federal Agencies, Accelerate Patch Deployment Timelines For Critical Infrastructure, Enhance Detection Capabilities For Privilege Escalation Attempts, Conduct Threat Hunting For Unc5174 Indicators Of Compromise (Iocs),

Incident : Privilege Escalation VMW2892328103125

Root Causes: Unpatched Vulnerability (Cve-2025-41244) In Vmware Aria Operations And Vmware Tools., Insufficient Monitoring For Privilege Escalation Attempts., State-Sponsored Actors (Unc5174) Leveraging Zero-Day Exploits For Espionage.,

Corrective Actions: Mandatory Patching Deadline (November 20, 2025) For Fceb Agencies., Public Disclosure Of Poc Code To Raise Awareness (Nviso)., Enhanced Collaboration Between Cisa, Vmware, And Security Researchers For Mitigation.,

Incident : ransomware BRO3362533111725

Root Causes: Third-Party Vendor Vulnerability (Bsh), Supply Chain Risk During Transition Period,

Incident : data breach BRO4981349111725

Root Causes: Third-Party Vulnerability (Bsh Compromise), Supply Chain Risk During Payroll Provider Transition,

Incident : ransomware BRO0893008112125

Root Causes: Use Of Unpatched Enterprise Software (Oracle E-Business Suite) With Zero-Day Vulnerability., Potential Lack Of Network Segmentation Allowing Lateral Movement., Targeting By A Sophisticated Threat Actor (Cl0P) With A History Of Exploiting Zero-Days.,

Incident : Ransomware BRO3105131112625

Root Causes: Unpatched Zero-Day Vulnerabilities In Oracle Ebs (Cve-2025-61882, Cve-2025-21884)., Lack Of Real-Time Monitoring For Unauthenticated Http Requests Targeting Critical Components (Bi Publisher, Configurator Ui)., Supplier Risk Blind Spots In Enterprise Software Supply Chains.,

Corrective Actions: Immediate Application Of Oracle-Provided Security Patches., Enhanced Supplier Risk Assessments Using Scrm Platforms (E.G., Z2Data)., Implementation Of Behavioral Wafs Or Anomaly Detection For Oracle Ebs Environments., Review Of Third-Party Software Dependencies For Similar Vulnerabilities.,

What is the company's process for conducting post-incident analysis ?

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Oversights in security monitoring, Monitoring for risky logins and unauthorized account misuse, Google Threat Intelligence Group (Gitg), Mandiant, Nviso (For Windows Variants), , Nviso (Vulnerability Reporting And Poc), Google Mandiant (Threat Actor Analysis), , Broadcom (Vmware) Security Patches, Nviso (Vulnerability Research), Google Mandiant (Threat Actor Analysis), , Recommended For All Organizations, , Nviso, Google Mandiant, , Recommended For Systems Running Vmware Tools With Sdmp, , Recommended: Review Security Logs For Unauthorized Access, Deploy Edr Solutions, , Mandiant (Google-Owned Cybersecurity Firm), .

What corrective actions has the company taken based on post-incident analysis ?

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Block Port 4011 On Firewalls, Configure The Irm Hostedserviceurl Core Setting With An Empty Value And Restart The Altiris Inventory Rule Management Service, Limit .Net Remoting Access To Localhost-Only In Upcoming Releases, , Deploy Mandiant’S Scanner Script For Brickstorm Detection., Audit And Restrict Entra Id Application Permissions., Enhance Monitoring For Websocket-Based C2 Traffic (E.G., Wss://Opra1.Oprawh.Workers[.]Dev)., Implement Network Segmentation To Isolate Vmware Environments., Extend Log Retention Policies To At Least 1 Year (To Cover 393-Day Dwell Time)., , Broadcom Released Patches For Cve-2025-41244 And Related Vmware Nsx Vulnerabilities., Nviso Published Poc To Aid Detection And Mitigation., Organizations Advised To Audit Vmware Environments For Signs Of Exploitation (E.G., Suspicious /Tmp/Httpd Binaries)., Enhanced Monitoring For Unc5174 Ttps (Tactics, Techniques, Procedures) Across Enterprise Software., , Enforce Bod 22-01 Compliance For Federal Agencies, Accelerate Patch Deployment Timelines For Critical Infrastructure, Enhance Detection Capabilities For Privilege Escalation Attempts, Conduct Threat Hunting For Unc5174 Indicators Of Compromise (Iocs), , Mandatory Patching Deadline (November 20, 2025) For Fceb Agencies., Public Disclosure Of Poc Code To Raise Awareness (Nviso)., Enhanced Collaboration Between Cisa, Vmware, And Security Researchers For Mitigation., , Immediate Application Of Oracle-Provided Security Patches., Enhanced Supplier Risk Assessments Using Scrm Platforms (E.G., Z2Data)., Implementation Of Behavioral Wafs Or Anomaly Detection For Oracle Ebs Environments., Review Of Third-Party Software Dependencies For Similar Vulnerabilities., .

Additional Questions

General Information

What was the amount of the last ransom demanded ?

Last Ransom Demanded: The amount of the last ransom demanded was ['$2 million', '$5 million'].

Who was the attacking group in the last incident ?

Last Attacking Group: The attacking group in the last incident were an SEXi ransomware (rebranded as APT INC), QilinHunters International, Scattered Spider (UNC3944, Scatter Swine, Oktapus, Octo Tempest, Storm-0875, Muddled Libra), UNC5221Silk Typhoon (disputed as same group by some vendors), UNC5174 (Chinese state-sponsored, linked to Ministry of State Security - MSS), UNC5174, UNC5174Houken (possibly linked), El Dorado ransomware group, El Dorado ransomware gangBlackLock operation, Cl0p ransomware gang and Cl0p (Clop).

Incident Details

What was the most recent incident detected ?

Most Recent Incident Detected: The most recent incident detected was on 2021-02-01.

What was the most recent incident publicly disclosed ?

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2023-11-20.

Impact of the Incidents

What was the highest financial loss from an incident ?

Highest Financial Loss: The highest financial loss from an incident was Hundreds of millions in damages.

What was the most significant data compromised in an incident ?

Most Significant Data Compromised: The most significant data compromised in an incident were passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers, account numbers, , Potentially sensitive customer data, Patient record systems, Transaction databases, , Potential unauthorized data access, Login credentials of enterprise administrators, Credentials, browser data, cookies, sensitive information, Emails of Key Individuals, Files from Email Mailboxes, , Broadcom employee data, , birthdates, email addresses, phone numbers, home addresses, national ID numbers, national health insurance ID numbers, health insurance policy numbers, financial account numbers, salary details, employment termination dates, and .

What was the most significant system affected in an incident ?

Most Significant System Affected: The most significant system affected in an incident was Symantec Enterprise Products and and VMware virtualization productsPatient record systemsTransaction databases and VMware Aria OperationsCloud FoundationTelco Cloud platforms and and Symantec Endpoint Management Suite 8.6.x-8.8 and VMware ESXi hypervisorsSnowflake cloud environmentsSlackMicrosoft TeamsExchange Online and VMware vCenter ServersESXi HostsNetwork AppliancesMicrosoft Entra ID Enterprise Applications and VMware Aria Operations (credential-based mode)VMware Tools (credential-less mode) and VMware Aria Operations (with SDMP enabled)VMware Tools on vulnerable VMs and VMware Aria OperationsVMware Tools (with SDMP enabled) and Oracle E-Business Suitesupply chain operationsfinancial systemscustomer datamanufacturing operationsresearch data and Oracle E-Business Suite (EBS) versions 12.2.3–12.2.14.

Response to the Incidents

What third-party assistance was involved in the most recent incident ?

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was google threat intelligence group (gitg), mandiant, nviso (for windows variants), , nviso (vulnerability reporting and poc), google mandiant (threat actor analysis), , broadcom (vmware) security patches, nviso (vulnerability research), google mandiant (threat actor analysis), , nviso, google mandiant, , mandiant (google-owned cybersecurity firm), .

What containment measures were taken in the most recent incident ?

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Block port 4011 on firewallsConfigure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Scanner Script for *nix-based Appliances (Mandiant)YARA Rule (G_APT_Backdoor_BRICKSTORM_3), Patch release for CVE-2025-41244Previous patches for CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 (March 2024)NSX vulnerabilities patched (November 2024), Patch application (mandated within 3 weeks for FCEB agencies)Discontinuing use of vulnerable products if patches unavailable, Patching VMware Tools (12.4.9 for Windows 32-bit, 12.5.4 for general; open-vm-tools for Linux)Disabling SDMP if patching is not feasible, Oracle security patches (CVE-2025-61882 and CVE-2025-21884).

Data Breach Information

What was the most sensitive data compromised in a breach ?

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were government agencies, Transaction databases, Emails of Key Individuals, birthdates, phone numbers, Broadcom employee data, Credentials, browser data, cookies, sensitive information, passwords, home addresses, national health insurance ID numbers, Login credentials of enterprise administrators, health insurance policy numbers, list of clients using Symantec's CloudSOC services, account numbers, list of Symantec clients, salary details, email addresses, national ID numbers, Potential unauthorized data access, Files from Email Mailboxes, Potentially sensitive customer data, account managers, Patient record systems, employment termination dates and financial account numbers.

Ransomware Information

Lessons Learned and Recommendations

What was the most significant lesson learned from past incidents ?

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Supply chain and ERP systems are attractive targets due to their central role in business operations., Supplier vulnerabilities in enterprise software (e.g., Oracle EBS) can cascade into large-scale breaches across industries. Proactive patch management and supply chain risk monitoring (e.g., via SCRM platforms like Z2Data) are critical to mitigating third-party risks. Cl0p’s delayed data leak strategy highlights the importance of rapid incident response to prevent public exposure of sensitive data.

What was the most significant recommendation implemented to improve cybersecurity ?

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Conduct regular audits of enterprise software for zero-day vulnerabilities., Deploy application controls to manage software execution, Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Configure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management Service, Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Enhance monitoring for risky logins and unauthorized account misuse, Implement network segmentation to limit lateral movement in case of breach., Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Prioritize vulnerability management for VMware products in federal and private-sector environments, Apply security patches for Oracle E-Business Suite as soon as they are released., Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Extend log retention periods to exceed average dwell times (393+ days)., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Consider network segmentation to limit impact of compromised VMs, Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Patch zero-day vulnerabilities in VMware and other appliances promptly., Limit .NET Remoting access to localhost-only in upcoming releases, Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Prepare incident response plans specifically for ransomware and zero-day scenarios., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Monitor systems for signs of privilege escalation or unauthorized root access., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Implement phishing-resistant multifactor authentication, Maintain offline backups stored separately from source systems, Block port 4011 on firewalls, Review and update incident response plans to include scenarios involving state-sponsored espionage., Evaluate the need for network segmentation to limit lateral movement in case of breaches., Review and update incident response plans for privilege escalation scenarios, Heightened vigilance, Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors., Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Urgent patch application, Immediately apply patches for CVE-2025-41244 as per vendor guidance, Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Segment networks to limit lateral movement via credential reuse., Deploy endpoint detection and response (EDR) solutions for early threat detection. and Implement YARA rules or Mandiant’s scanner script for *nix-based systems..

References

What is the most recent source of information about an incident ?

Most Recent Source: The most recent source of information about an incident are Google Threat Intelligence Group (GITG), Australian Federal Police (AFP), NVISO Research (Maxime Thiebaut), CISA Known Exploited Vulnerabilities (KEV) Catalog, The Register, Cybersecurity and Infrastructure Security Agency (CISA), TechRadar, United Kingdom’s National Cyber Security Centre (NCSC-UK), U.S. Cybersecurity and Infrastructure Security Agency (CISA), LRQA security researchers, Federal Bureau of Investigation (FBI), Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), VMware, Broadcom PSIRT, CISA Advisory on CVE-2025-41244, Google Mandiant - UNC5174 Threat Actor Profile, Z2Data Supplier Risk Analysis, Google Report on BRICKSTORM (April 2024), NVISO (Proof-of-Concept Release), Broadcom Security Advisory for CVE-2025-41244, GBHackers (GBH), Oracle Security Alerts (CVE-2025-61882, CVE-2025-21884), Royal Canadian Mounted Police (RCMP), NVISO Report on BRICKSTORM Windows Variants, NVISO Research (Maxime Thiebaut) - Proof of Concept, Canadian Centre for Cyber Security (CCCS), BleepingComputer, Google Mandiant (UNC5174 Analysis), UK National Cyber Security Centre (NCSC), Mandiant (Google-owned cybersecurity firm), Google Mandiant BRICKSTORM Scanner Script, Microsoft Threat Intelligence (VMware Zero-Days and March 2024).

What is the most recent URL for additional resources on cybersecurity best practices ?

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://www.bleepingcomputer.com, https://www.techradar.com, https://www.z2data.com .

Investigation Status

What is the current status of the most recent investigation ?

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.

Stakeholder and Customer Advisories

What was the most recent stakeholder advisory issued ?

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was CISA alert to FCEB agencies, Broadcom customer notifications, CISA KEV advisory, VMware security bulletin (implied), Oracle security alerts urging immediate patching, Mandiant’s analysis of Cl0p’s modus operandi, .

What was the most recent customer advisory issued ?

Most Recent Customer Advisory: The most recent customer advisory issued were an Broadcom urged customers to apply patches immediately; no detailed advisory provided in the article., Urgent patching recommendations for VMware Aria Operations/Tools users, VMware patch notificationsSecurity researcher disclosures (e.g., NVISO, Mandiant) and Companies advised to monitor for data leaks on Cl0p’s blog or dark web marketplaces.

Initial Access Broker

What was the most recent entry point used by an initial access broker ?

Most Recent Entry Point: The most recent entry point used by an initial access broker were an unpatched zero-day vulnerability in Oracle E-Business Suite, VMware virtualization products, Social engineering, Executable File, Poisoned ad on Google Ads network and Port 4011.

What was the most recent reconnaissance period for an incident ?

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Since at least mid-October 2024 (per NVISO), At least since mid-October 2024 (per NVISO)Potentially longer (up to a year, per researchers), Since late September 2023 (pre-exploitation activity).

Post-Incident Analysis

What was the most significant root cause identified in post-incident analysis ?

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Oversights in security monitoringIneffective segmentationDelay in implementing available patches, Exploitation of Kickidler tool, Insecure deserialization of .NET objects through the BinaryServerFormatterSinkProvider with TypeFilterLevel set to Full, Exploitation of unpatched zero-day vulnerabilities in network appliances.Lack of EDR support on targeted systems (e.g., VMware vCenter).Insufficient log retention (dwell time exceeded retention periods).Overprivileged Microsoft Entra ID applications (mail.read, full_access_as_app).Credential harvesting via HTTP basic auth and MFA bypass techniques., Privilege escalation vulnerability in VMware service discovery mechanism (broad regex path matching).Insufficient validation of unprivileged user processes opening listening sockets.Delayed public disclosure of in-the-wild exploitation (attacks began in October 2024; patch/report in November 2024).Reuse of exploit techniques across multiple vulnerabilities (e.g., CVE-2023-46747, CVE-2024-1709) by UNC5174., Delayed patching of known critical vulnerability (CVE-2025-41244)Insufficient privilege separation in VMware Tools/Aria OperationsState-sponsored actor (UNC5174) leveraging zero-day exploitation chain, Unpatched vulnerability (CVE-2025-41244) in VMware Aria Operations and VMware Tools.Insufficient monitoring for privilege escalation attempts.State-sponsored actors (UNC5174) leveraging zero-day exploits for espionage., third-party vendor vulnerability (BSH)supply chain risk during transition period, third-party vulnerability (BSH compromise)supply chain risk during payroll provider transition, Use of unpatched enterprise software (Oracle E-Business Suite) with zero-day vulnerability.Potential lack of network segmentation allowing lateral movement.Targeting by a sophisticated threat actor (Cl0p) with a history of exploiting zero-days., Unpatched zero-day vulnerabilities in Oracle EBS (CVE-2025-61882, CVE-2025-21884).Lack of real-time monitoring for unauthenticated HTTP requests targeting critical components (BI Publisher, Configurator UI).Supplier risk blind spots in enterprise software supply chains..

What was the most significant corrective action taken based on post-incident analysis ?

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Block port 4011 on firewallsConfigure the IRM_HostedServiceUrl core setting with an empty value and restart the Altiris Inventory Rule Management ServiceLimit .NET Remoting access to localhost-only in upcoming releases, Deploy Mandiant’s scanner script for BRICKSTORM detection.Audit and restrict Entra ID application permissions.Enhance monitoring for WebSocket-based C2 traffic (e.g., wss://opra1.oprawh.workers[.]dev).Implement network segmentation to isolate VMware environments.Extend log retention policies to at least 1 year (to cover 393-day dwell time)., Broadcom released patches for CVE-2025-41244 and related VMware NSX vulnerabilities.NVISO published PoC to aid detection and mitigation.Organizations advised to audit VMware environments for signs of exploitation (e.g., suspicious /tmp/httpd binaries).Enhanced monitoring for UNC5174 TTPs (tactics, techniques, procedures) across enterprise software., Enforce BOD 22-01 compliance for federal agenciesAccelerate patch deployment timelines for critical infrastructureEnhance detection capabilities for privilege escalation attemptsConduct threat hunting for UNC5174 indicators of compromise (IOCs), Mandatory patching deadline (November 20, 2025) for FCEB agencies.Public disclosure of POC code to raise awareness (NVISO).Enhanced collaboration between CISA, VMware, and security researchers for mitigation., Immediate application of Oracle-provided security patches.Enhanced supplier risk assessments using SCRM platforms (e.g., Z2Data).Implementation of behavioral WAFs or anomaly detection for Oracle EBS environments.Review of third-party software dependencies for similar vulnerabilities..

References

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=vmware' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation

Rapid

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network Security

Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)

Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)

Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat Intelligence

Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest reports → View all security reports →

Badge your company to reduce your risk score and your cyber insurance costs!

Badge your company to reduce your risk score and your cyber insurance costs!

VMware Company CyberSecurity Posture

VMware A.I CyberSecurity Scoring

VMware Company CyberSecurity News & History

Attack with significant impact with internal employee data leaks

Attack with significant impact with internal employee data leaks

Attack threatening the organization’s existence

Attack threatening the organization’s existence

Attack without any consequences

Attack with significant impact with customers data leaks

Attack with significant impact with internal employee data leaks

Attack with significant impact with internal employee data leaks

Attack threatening the organization’s existence

Attack threatening the organization’s existence

Attack threatening the organization’s existence

Attack with significant impact with customers data leaks

Attack with significant impact with internal employee data leaks

Attack with significant impact with customers data leaks

Attack with significant impact with internal employee data leaks

Broadcom

Broadcom

Broadcom

Broadcom

Broadcom

Broadcom (VMware)

Symantec

Symantec

VMware (Broadcom Inc.)

VMware

VMware

VMware

VMware

Broadcom (VMware)

Broadcom (VMware)

VMware

VMware Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

A.I Risk Score Likelihood 3 - 6 - 9 months

Underwriter Stats for VMware

Incidents vs Software Development Industry Average (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types VMware vs Software Development Industry Avg (This Year)

Incident History — VMware (X = Date, Y = Severity)

VMware Company Subsidiaries

VMwareLast updated: N/A

VMware

VMware Similar Companies

Walmart Global Tech

IDEMIA

ServiceNow

Juniper Networks

Baidu, Inc.

UKG

Synopsys Inc

OpenText

NiCE

VMware CyberSecurity News

CISA Warns of Actively Exploited 0-Day Vulnerabilities in VMware Tools and Aria Operations

CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks

XWiki and VMware flaws added to CISA list of exploited vulnerabilities

CISA adds VMware bug to KEV a year after first exploited

CISA Warns of VMware Tools and Aria Operations 0-Day Vulnerability Exploited in Attacks

CISA Adds Exploited XWiki, VMware Flaws to KEV Catalog

CISA orders feds to patch VMware Tools flaw exploited by Chinese hackers

U.S. CISA adds XWiki Platform, and Broadcom VMware Aria Operations and VMware Tools flaws to its Known Expl...

Agenda Ransomware Actors Deploying Linux RAT on Windows Systems Targeting VMware Deployments

Frequently Asked Questions

VMware CyberSecurity History Information

Official Website of VMware

VMware’s AI-Generated Cybersecurity Score

How many security badges does VMware’ have ?

Does VMware have SOC 2 Type 1 certification ?

Does VMware have SOC 2 Type 2 certification ?

Does VMware comply with GDPR ?

Does VMware have PCI DSS certification ?

Does VMware comply with HIPAA ?

Does VMware have ISO 27001 certification ?

Industry Classification of VMware

Number of Employees at VMware