Internal validation & live display

Multiple badges & continuous verification

Faster underwriting decisions

https://images.rankiteo.com/companyimages/vmware.jpeg

VMware Company CyberSecurity Posture

broadcom.com

VMware by Broadcom delivers software that unifies and streamlines hybrid cloud environments for the world’s most complex organizations. By combining public-cloud scale and agility with private-cloud security and performance, we empower our customers to modernize, optimize and protect their apps and businesses everywhere. Capable of deployment in the software-defined data center, cloud environments, any app and the enterprise edge, our comprehensive software portfolio makes global enterprises more innovative, connected, resilient and secure.

VMware A.I CyberSecurity Scoring

VMware

Company Details

Linkedin ID:

vmware

Website:

https://www.broadcom.com/info/vmware

Employees number:

13,658

Number of followers:

2,032,204

NAICS:

5112

Industry Type:

Software Development

Homepage:

broadcom.com

IP Addresses:

555

Company ID:

VMW_1948473

Scan Status:

Completed

VMware Risk Score (AI oriented)

Between 0 and 549

VMware Software Development

Updated: 11/12/2025

Powered by our proprietary A.I cyber incident model
Insurance preferes TPRM score to calculate premium

VMware Global Score (TPRM)

XXXX

VMware Software Development

—

Instant access to detailed risk factors
Benchmark vs. industry & size peers

Vulnerabilities
Findings

VMware Company CyberSecurity News & History

Past Incidents

Attack Types

Entity	Type	Severity	Impact	Seen	Incident Details
Broadcom	Ransomware	85	3	9/2024	BRO3362533111725
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: A ransomware attack targeted Business Systems House (BSH), a Middle Eastern payroll partner of ADP, in September 2024, leading to the theft of Broadcom’s employee data. The compromised data was leaked online in December 2024, but Broadcom was not notified until May 2025—an eight-month delay. The El Dorado ransomware group claimed responsibility, exploiting Broadcom’s ongoing transition between payroll providers. The breach exposed sensitive employee information, including personal and financial details, while Broadcom was still dependent on ADP and BSH for payroll processing. The incident underscores critical vulnerabilities in third-party supply chain security, particularly during vendor transitions, and highlights the prolonged risks of undetected data exfiltration in ransomware attacks. The delayed disclosure further exacerbated reputational and operational risks for Broadcom, a global semiconductor and infrastructure software leader.
Broadcom	Ransomware	100	5	6/2025	BRO3105131112625
Rankiteo Explanation : Attack threatening the organization’s existence Description: Broadcom, a global technology leader valued at hundreds of billions, was among the high-profile victims of Cl0p’s ransomware attack exploiting a zero-day vulnerability in Oracle’s E-Business Suite (CVE-2025-61882 and CVE-2025-21884). The cybercriminal group exfiltrated sensitive corporate and customer data, threatening to leak or sell it unless a ransom was paid. The breach compromised critical systems, risking financial records, proprietary business data, and third-party customer information. Cl0p’s extortion tactics included warnings of public disclosure on their blog, torrent leaks, or sales to malicious actors, amplifying reputational and operational risks. Given Broadcom’s role in semiconductor and infrastructure technology, the attack posed supply chain cascading risks, potentially disrupting clients reliant on its products. Oracle issued emergency patches, but the damage—including data theft, potential regulatory fines, and erosion of stakeholder trust—had already occurred. The incident underscores vulnerabilities in enterprise software dependencies, with Broadcom facing long-term financial and strategic repercussions if the stolen data is weaponized.
Broadcom	Ransomware	100	5	5/2025	BRO0893008112125
Rankiteo Explanation : Attack threatening the organization’s existence Description: The Cl0p ransomware gang breached Broadcom, a $300+ billion semiconductor and infrastructure software leader, by exploiting an unpatched zero-day vulnerability in Oracle E-Business Suite. This ERP platform manages critical operations, including supply chain, financial systems, and customer data, making it a high-value target. The attackers likely exfiltrated sensitive corporate data (potentially including intellectual property, manufacturing secrets, and customer information) before deploying ransomware, following Cl0p’s typical double-extortion tactic. The breach risks operational disruptions in global manufacturing, regulatory penalties for data exposure, and reputational damage due to the involvement of a notorious ransomware group. The use of a zero-day exploit amplifies the threat, as other organizations using Oracle E-Business Suite may face similar attacks until a patch is released. Broadcom has not confirmed the incident, but the alleged compromise aligns with Cl0p’s pattern of targeting high-value enterprises via unpatched vulnerabilities in widely used software.
Broadcom (VMware)	Vulnerability	85	4	6/2023	BRO4592445093025
Rankiteo Explanation : Attack with significant impact with customers data leaks Description: Broadcom patched a high-severity privilege escalation vulnerability (CVE-2025-41244) in VMware Aria Operations and VMware Tools, actively exploited since October 2024 by UNC5174, a Chinese state-sponsored threat actor linked to China’s Ministry of State Security (MSS). The flaw allows an unprivileged local attacker to escalate privileges to root-level code execution by staging a malicious binary in paths like `/tmp/httpd` and exploiting VMware’s service discovery mechanism. UNC5174, known for selling network access to U.S. defense contractors, UK government entities, and Asian institutions, previously exploited CVE-2023-46747 (F5 BIG-IP), CVE-2024-1709 (ConnectWise ScreenConnect), and CVE-2025-31324 (SAP NetWeaver).The vulnerability poses a critical risk as it enables full system compromise, potentially allowing attackers to move laterally across networks, steal sensitive data, or deploy additional malware. While no direct data breach or ransomware was confirmed in this case, the exploitation by a state-backed APT group suggests espionage or pre-positioning for future attacks. Broadcom also patched two other high-severity VMware NSX flaws reported by the NSA, indicating a broader pattern of targeted cyber operations against enterprise infrastructure.
Symantec	Breach	60	3	2/2021	SYM1336271222
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: Security firm Symantec was attacked by a hacker back in February 2021 in which the hackers extracted some of the data. This comprises not only passwords but a list of Symantec clients -- including government agencies. The hacker was able to access a list of clients using Symantec's CloudSOC services, account managers and account numbers.
Symantec	Vulnerability	60	3	06/2016	SYM44121823
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: Tavis Ormandy identified Symantec and Norton flaws that cybercriminals may use to gain access to users' data. There were 17 items on the list of vulnerable Symantec enterprise products. On the Symantec website, these items had been listed as a security advisory. Malware concealed in an executable file had a chance to obtain total access to the computer running the operating system, it was discovered that Symantec decompressed files in the operating system's kernel.
VMware (Broadcom Inc.)	Cyber Attack	100	5	3/2025	VMW1132111092525
Rankiteo Explanation : Attack threatening the organization’s existence Description: Chinese-aligned threat group UNC5221 deployed the BRICKSTORM backdoor on VMware vCenter and ESXi hosts, targeting US legal, tech, and SaaS firms since at least March 2025. The attack exploited zero-day vulnerabilities in network appliances to gain initial access, followed by privilege escalation (MFA bypass, credential harvesting, VM cloning) and lateral movement via stolen credentials. The primary objective was email exfiltration from high-value targets, including key executives, with evidence of file theft from compromised mailboxes. The backdoor established persistence through systemd/rc.local modifications, ensuring survival across reboots, while communicating with a hardcoded C2 server via WebSockets. The 393-day average dwell time allowed deep infiltration, with attackers leveraging Microsoft Entra ID Enterprise Applications to access sensitive emails. Though no ransomware or direct financial fraud was reported, the breach compromised intellectual property, strategic communications, and potentially client-confidential data, posing long-term risks to corporate espionage, supply-chain attacks, and zero-day development by state-backed actors. VMware’s role as a critical infrastructure provider amplifies the impact, as compromised vCenter servers could enable downstream attacks on customer environments. The sophistication of the campaign—including in-memory servlet injections and automated secret-stealer tools—suggests a nation-state-level operation with implications beyond immediate data theft.
VMware	Ransomware	100		7/2025	VMW410073025
Rankiteo Explanation : Attack threatening the organization’s existence Description: Scattered Spider, a cybercriminal group, has recently targeted VMware ESXi hypervisors, encrypting entire virtual machine infrastructures using DragonForce ransomware. This attack cripples critical infrastructure, rendering virtual machines inoperable. The group gained initial access through sophisticated social engineering tactics, escalated privileges to gain administrative control, and deployed remote monitoring tools before executing the ransomware. The attack has led to significant financial damages and operational disruptions.
VMware	Ransomware	100		5/2025	VMW222051225
Rankiteo Explanation : Attack threatening the organization's existence: Attack in which the personal and financial information is compromised, Attack which stop a factory, Attack which take over on all data from a company, Attack which take specific data like patents, Attack in which company is requested to pay a ransom or ransomware involved Description: Hackers are exploiting the legitimate employee monitoring tool Kickidler to obtain login credentials and deploy ransomware encryptors. The attack begins with a poisoned ad on the Google Ads network, leading to a trojanized version of RVTools. This version deploys a backdoor called SMOKEDHAM, which is then used to install Kickidler. The tool is specifically used to target enterprise administrators and their login credentials. The goal is to infiltrate the network and deploy the encryptor. The payloads targeted VMware ESXi infrastructure, encrypting VMDK virtual hard drives. The groups Qilin and Hunters International are focused on cloud backups but have faced challenges due to defenders decoupling backup system authentication from Windows domains.
VMware	Ransomware	100	5	7/2024	VMW000072224
Rankiteo Explanation : Attack threatening the organization’s existence Description: The SEXi ransomware, which recently rebranded itself as APT INC, continues to plague VMware's ESXi servers, causing significant disruptions to services and potentially leaking sensitive customer data. The attacks underscore the critical vulnerabilities within the ESXi platform and the importance of robust security measures to prevent such incidents.
Broadcom (VMware)	Vulnerability	60	3	10/2024	VMW3002130103125
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: The article highlights an actively exploited high-severity vulnerability (CVE-2025-41244) in Broadcom’s VMware Aria Operations and VMware Tools, allowing local attackers with non-administrative VM access to escalate privileges to root. Exploited since October 2024 by UNC5174, a Chinese state-sponsored threat actor linked to China’s Ministry of State Security (MSS), the flaw enables attackers to execute arbitrary code at the highest privilege level. The actor has historically targeted U.S. defense contractors, UK government entities, and Asian institutions, selling network access post-compromise. CISA mandated federal agencies patch within three weeks (by November 20, 2025) under BOD 22-01, warning of significant risks to federal enterprise if left unpatched. While no direct data breach or financial loss is reported, the vulnerability’s exploitation could lead to full system compromise, enabling lateral movement, data exfiltration, or deployment of further malware (e.g., ransomware). Given the actor’s ties to state-sponsored espionage, the risk extends to intellectual property theft, supply chain attacks, or disruption of critical operations in defense and government sectors.
Broadcom (VMware)	Vulnerability	85	4	6/2024	VMW2892328103125
Rankiteo Explanation : Attack with significant impact with customers data leaks Description: The CVE-2025-41244 vulnerability in VMware Aria Operations and VMware Tools (with SDMP enabled) was exploited by the Chinese state-sponsored group UNC5174 for espionage targeting Western and Asian institutions, including US defense contractors, UK government agencies, and Asian organizations. The flaw allowed local privilege escalation, enabling attackers with non-admin access to a VM to gain root privileges, facilitating deeper system compromise. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch by November 20, 2025, or discontinue use. Evidence suggests UNC5174 (linked to China’s Ministry of State Security) had been abusing this flaw since mid-2024, alongside other zero-days in Ivanti Cloud Services Appliance (CSA) to breach French government agencies, telcos, finance, and transportation sectors. The exploitation risks unauthorized access to sensitive defense, government, and corporate networks, potentially leading to data exfiltration, lateral movement, and long-term espionage. While no direct data breach or ransomware was confirmed in this case, the targeted nature of the attacks—focusing on high-value institutions—poses severe national security and economic risks if left unpatched.
VMware	Vulnerability	85	3	4/2025	VMW806040125
Rankiteo Explanation : Attack with significant impact with internal employee data leaks Description: VMware has announced a critical security issue VMSA-2025-0006, a high-severity vulnerability affecting Aria Operations. This vulnerability, CVE-2025-22231, enables attackers with local access to escalate privileges to root level, potentially resulting in full system control. This may lead to unauthorized data access, service disruptions, or further network compromise. Important to note is that exploitation requires existing local administrative access. Targeted systems include VMware Aria Operations, Cloud Foundation, and Telco Cloud platforms. While patches are available, unpatched systems are still at risk. The flaw’s discovery was credited to researchers from MoyunSec Vlab.

Broadcom

Ransomware

Severity: 85

Impact: 3

Seen: 9/2024

Blog:

BRO3362533111725

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: A ransomware attack targeted **Business Systems House (BSH)**, a Middle Eastern payroll partner of **ADP**, in **September 2024**, leading to the theft of **Broadcom’s employee data**. The compromised data was leaked online in **December 2024**, but Broadcom was not notified until **May 2025**—an eight-month delay. The **El Dorado ransomware group** claimed responsibility, exploiting Broadcom’s ongoing transition between payroll providers. The breach exposed sensitive employee information, including personal and financial details, while Broadcom was still dependent on ADP and BSH for payroll processing. The incident underscores critical vulnerabilities in **third-party supply chain security**, particularly during vendor transitions, and highlights the prolonged risks of undetected data exfiltration in ransomware attacks. The delayed disclosure further exacerbated reputational and operational risks for Broadcom, a global semiconductor and infrastructure software leader.

Broadcom

Ransomware

Severity: 100

Impact: 5

Seen: 6/2025

Blog:

BRO3105131112625

Rankiteo Explanation

Attack threatening the organization’s existence

Description: Broadcom, a global technology leader valued at hundreds of billions, was among the high-profile victims of **Cl0p’s ransomware attack** exploiting a **zero-day vulnerability in Oracle’s E-Business Suite (CVE-2025-61882 and CVE-2025-21884)**. The cybercriminal group **exfiltrated sensitive corporate and customer data**, threatening to leak or sell it unless a ransom was paid. The breach compromised critical systems, risking **financial records, proprietary business data, and third-party customer information**. Cl0p’s extortion tactics included warnings of **public disclosure on their blog, torrent leaks, or sales to malicious actors**, amplifying reputational and operational risks. Given Broadcom’s role in semiconductor and infrastructure technology, the attack posed **supply chain cascading risks**, potentially disrupting clients reliant on its products. Oracle issued emergency patches, but the damage—including **data theft, potential regulatory fines, and erosion of stakeholder trust**—had already occurred. The incident underscores vulnerabilities in enterprise software dependencies, with Broadcom facing **long-term financial and strategic repercussions** if the stolen data is weaponized.

Broadcom

Ransomware

Severity: 100

Impact: 5

Seen: 5/2025

Blog:

BRO0893008112125

Rankiteo Explanation

Attack threatening the organization’s existence

Description: The **Cl0p ransomware gang** breached **Broadcom**, a $300+ billion semiconductor and infrastructure software leader, by exploiting an **unpatched zero-day vulnerability in Oracle E-Business Suite**. This ERP platform manages critical operations, including **supply chain, financial systems, and customer data**, making it a high-value target. The attackers likely **exfiltrated sensitive corporate data** (potentially including **intellectual property, manufacturing secrets, and customer information**) before deploying ransomware, following Cl0p’s typical double-extortion tactic. The breach risks **operational disruptions in global manufacturing**, **regulatory penalties for data exposure**, and **reputational damage** due to the involvement of a notorious ransomware group. The use of a **zero-day exploit** amplifies the threat, as other organizations using Oracle E-Business Suite may face similar attacks until a patch is released. Broadcom has not confirmed the incident, but the alleged compromise aligns with Cl0p’s pattern of targeting **high-value enterprises** via unpatched vulnerabilities in widely used software.

Broadcom (VMware)

Vulnerability

Severity: 85

Impact: 4

Seen: 6/2023

Blog:

BRO4592445093025

Rankiteo Explanation

Attack with significant impact with customers data leaks

Description: Broadcom patched a **high-severity privilege escalation vulnerability (CVE-2025-41244)** in **VMware Aria Operations** and **VMware Tools**, actively exploited since **October 2024** by **UNC5174**, a **Chinese state-sponsored threat actor** linked to China’s Ministry of State Security (MSS). The flaw allows an **unprivileged local attacker** to escalate privileges to **root-level code execution** by staging a malicious binary in paths like `/tmp/httpd` and exploiting VMware’s service discovery mechanism. UNC5174, known for selling network access to **U.S. defense contractors, UK government entities, and Asian institutions**, previously exploited **CVE-2023-46747 (F5 BIG-IP)**, **CVE-2024-1709 (ConnectWise ScreenConnect)**, and **CVE-2025-31324 (SAP NetWeaver)**.The vulnerability poses a **critical risk** as it enables **full system compromise**, potentially allowing attackers to **move laterally across networks**, **steal sensitive data**, or **deploy additional malware**. While no **direct data breach or ransomware** was confirmed in this case, the exploitation by a **state-backed APT group** suggests **espionage or pre-positioning for future attacks**. Broadcom also patched **two other high-severity VMware NSX flaws** reported by the **NSA**, indicating a broader pattern of **targeted cyber operations** against enterprise infrastructure.

Symantec

Breach

Severity: 60

Impact: 3

Seen: 2/2021

Blog:

SYM1336271222

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: Security firm Symantec was attacked by a hacker back in February 2021 in which the hackers extracted some of the data. This comprises not only passwords but a list of Symantec clients -- including government agencies. The hacker was able to access a list of clients using Symantec's CloudSOC services, account managers and account numbers.

Symantec

Vulnerability

Severity: 60

Impact: 3

Seen: 06/2016

Blog:

SYM44121823

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: Tavis Ormandy identified Symantec and Norton flaws that cybercriminals may use to gain access to users' data. There were 17 items on the list of vulnerable Symantec enterprise products. On the Symantec website, these items had been listed as a security advisory. Malware concealed in an executable file had a chance to obtain total access to the computer running the operating system, it was discovered that Symantec decompressed files in the operating system's kernel.

VMware (Broadcom Inc.)

Cyber Attack

Severity: 100

Impact: 5

Seen: 3/2025

Blog:

VMW1132111092525

Rankiteo Explanation

Attack threatening the organization’s existence

Description: Chinese-aligned threat group **UNC5221** deployed the **BRICKSTORM backdoor** on **VMware vCenter and ESXi hosts**, targeting US legal, tech, and SaaS firms since at least **March 2025**. The attack exploited **zero-day vulnerabilities** in network appliances to gain initial access, followed by **privilege escalation** (MFA bypass, credential harvesting, VM cloning) and **lateral movement** via stolen credentials. The primary objective was **email exfiltration** from high-value targets, including key executives, with evidence of **file theft from compromised mailboxes**. The backdoor established persistence through **systemd/rc.local modifications**, ensuring survival across reboots, while communicating with a **hardcoded C2 server** via WebSockets. The **393-day average dwell time** allowed deep infiltration, with attackers leveraging **Microsoft Entra ID Enterprise Applications** to access sensitive emails. Though no **ransomware** or **direct financial fraud** was reported, the breach compromised **intellectual property, strategic communications, and potentially client-confidential data**, posing long-term risks to **corporate espionage, supply-chain attacks, and zero-day development** by state-backed actors. VMware’s role as a **critical infrastructure provider** amplifies the impact, as compromised vCenter servers could enable **downstream attacks** on customer environments. The sophistication of the campaign—including **in-memory servlet injections** and **automated secret-stealer tools**—suggests a **nation-state-level operation** with implications beyond immediate data theft.

VMware

Ransomware

Severity: 100

Impact:

Seen: 7/2025

Blog:

VMW410073025

Rankiteo Explanation

Attack threatening the organization’s existence

Description: Scattered Spider, a cybercriminal group, has recently targeted VMware ESXi hypervisors, encrypting entire virtual machine infrastructures using DragonForce ransomware. This attack cripples critical infrastructure, rendering virtual machines inoperable. The group gained initial access through sophisticated social engineering tactics, escalated privileges to gain administrative control, and deployed remote monitoring tools before executing the ransomware. The attack has led to significant financial damages and operational disruptions.

VMware

Ransomware

Severity: 100

Impact:

Seen: 5/2025

Blog:

VMW222051225

Rankiteo Explanation

Attack threatening the organization's existence: Attack in which the personal and financial information is compromised, Attack which stop a factory, Attack which take over on all data from a company, Attack which take specific data like patents, Attack in which company is requested to pay a ransom or ransomware involved

Description: Hackers are exploiting the legitimate employee monitoring tool Kickidler to obtain login credentials and deploy ransomware encryptors. The attack begins with a poisoned ad on the Google Ads network, leading to a trojanized version of RVTools. This version deploys a backdoor called SMOKEDHAM, which is then used to install Kickidler. The tool is specifically used to target enterprise administrators and their login credentials. The goal is to infiltrate the network and deploy the encryptor. The payloads targeted VMware ESXi infrastructure, encrypting VMDK virtual hard drives. The groups Qilin and Hunters International are focused on cloud backups but have faced challenges due to defenders decoupling backup system authentication from Windows domains.

VMware

Ransomware

Severity: 100

Impact: 5

Seen: 7/2024

Blog:

VMW000072224

Rankiteo Explanation

Attack threatening the organization’s existence

Description: The SEXi ransomware, which recently rebranded itself as APT INC, continues to plague VMware's ESXi servers, causing significant disruptions to services and potentially leaking sensitive customer data. The attacks underscore the critical vulnerabilities within the ESXi platform and the importance of robust security measures to prevent such incidents.

Broadcom (VMware)

Vulnerability

Severity: 60

Impact: 3

Seen: 10/2024

Blog:

VMW3002130103125

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: The article highlights an actively exploited high-severity vulnerability (**CVE-2025-41244**) in **Broadcom’s VMware Aria Operations and VMware Tools**, allowing local attackers with non-administrative VM access to escalate privileges to **root**. Exploited since **October 2024** by **UNC5174**, a Chinese state-sponsored threat actor linked to China’s Ministry of State Security (MSS), the flaw enables attackers to execute arbitrary code at the highest privilege level. The actor has historically targeted **U.S. defense contractors, UK government entities, and Asian institutions**, selling network access post-compromise. CISA mandated federal agencies patch within **three weeks** (by **November 20, 2025**) under **BOD 22-01**, warning of **significant risks to federal enterprise** if left unpatched. While no direct data breach or financial loss is reported, the vulnerability’s exploitation could lead to **full system compromise**, enabling lateral movement, data exfiltration, or deployment of further malware (e.g., ransomware). Given the actor’s ties to **state-sponsored espionage**, the risk extends to **intellectual property theft, supply chain attacks, or disruption of critical operations** in defense and government sectors.

Broadcom (VMware)

Vulnerability

Severity: 85

Impact: 4

Seen: 6/2024

Blog:

VMW2892328103125

Rankiteo Explanation

Attack with significant impact with customers data leaks

Description: The **CVE-2025-41244** vulnerability in **VMware Aria Operations and VMware Tools** (with SDMP enabled) was exploited by the **Chinese state-sponsored group UNC5174** for **espionage** targeting **Western and Asian institutions**, including **US defense contractors, UK government agencies, and Asian organizations**. The flaw allowed **local privilege escalation**, enabling attackers with non-admin access to a VM to gain **root privileges**, facilitating deeper system compromise. The **US Cybersecurity and Infrastructure Security Agency (CISA)** added it to the **Known Exploited Vulnerabilities (KEV) catalog**, mandating federal agencies to patch by **November 20, 2025**, or discontinue use. Evidence suggests **UNC5174 (linked to China’s Ministry of State Security)** had been abusing this flaw since **mid-2024**, alongside other zero-days in **Ivanti Cloud Services Appliance (CSA)** to breach **French government agencies, telcos, finance, and transportation sectors**. The exploitation risks **unauthorized access to sensitive defense, government, and corporate networks**, potentially leading to **data exfiltration, lateral movement, and long-term espionage**. While no direct **data breach or ransomware** was confirmed in this case, the **targeted nature of the attacks**—focusing on **high-value institutions**—poses severe **national security and economic risks** if left unpatched.

VMware

Vulnerability

Severity: 85

Impact: 3

Seen: 4/2025

Blog:

VMW806040125

Rankiteo Explanation

Attack with significant impact with internal employee data leaks

Description: VMware has announced a critical security issue VMSA-2025-0006, a high-severity vulnerability affecting Aria Operations. This vulnerability, CVE-2025-22231, enables attackers with local access to escalate privileges to root level, potentially resulting in full system control. This may lead to unauthorized data access, service disruptions, or further network compromise. Important to note is that exploitation requires existing local administrative access. Targeted systems include VMware Aria Operations, Cloud Foundation, and Telco Cloud platforms. While patches are available, unpatched systems are still at risk. The flaw’s discovery was credited to researchers from MoyunSec Vlab.

VMware Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

🔒

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

🔒

A.I. Risk Score Predictions locked

Access Monitoring Plan

Underwriter Stats for VMware

Incidents vs Software Development Industry Average (This Year)

VMware has 601.75% more incidents than the average of same-industry companies with at least one recorded incident.

Incidents vs All-Companies Average (This Year)

VMware has 412.82% more incidents than the average of all companies with at least one recorded incident.

Incident Types VMware vs Software Development Industry Avg (This Year)

VMware reported 4 incidents this year: 1 cyber attacks, 2 ransomware, 1 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.

Incident History — VMware (X = Date, Y = Severity)

VMware cyber incidents detection timeline including parent company and subsidiaries

VMware Company Subsidiaries

Security Report → Compare→

Dassault Systèmes

3ds.com

Dassault Systèmes is a catalyst for human progress. Since 1981, the company has pioneered virtual worlds to improve real life for consumers, patients and citizens. With Dassault Systèmes’ 3DEXPERIENCE platform, 370,000 customers of all sizes, in all industries, can collaborate, imagine and create

Security Report → Compare→

Read Article →

December 05, 2025 09:13 AM

CISA, NSA sound alarm on Brickstorm backdoor used by China-linked actors targeting VMware, Windows systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Canadian Cyber Centre are...

Read Article →

Frequently Asked Questions

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.

VMware CyberSecurity History Information

Official Website of VMware

The official website of VMware is https://www.broadcom.com/info/vmware.

VMware’s AI-Generated Cybersecurity Score

According to Rankiteo, VMware’s AI-generated cybersecurity score is 423, reflecting their Critical security posture.

How many security badges does VMware’ have ?

According to Rankiteo, VMware currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Does VMware have SOC 2 Type 1 certification ?

According to Rankiteo, VMware is not certified under SOC 2 Type 1.

Does VMware have SOC 2 Type 2 certification ?

According to Rankiteo, VMware does not hold a SOC 2 Type 2 certification.

Does VMware comply with GDPR ?

According to Rankiteo, VMware is not listed as GDPR compliant.

Does VMware have PCI DSS certification ?

According to Rankiteo, VMware does not currently maintain PCI DSS compliance.

Does VMware comply with HIPAA ?

According to Rankiteo, VMware is not compliant with HIPAA regulations.

Does VMware have ISO 27001 certification ?

According to Rankiteo,VMware is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Industry Classification of VMware

VMware operates primarily in the Software Development industry.

Number of Employees at VMware

VMware employs approximately 13,658 people worldwide.

Subsidiaries Owned by VMware

VMware presently has no subsidiaries across any sectors.

VMware’s LinkedIn Followers

VMware’s official LinkedIn profile has approximately 2,032,204 followers.

NAICS Classification of VMware

VMware is classified under the NAICS code 5112, which corresponds to Software Publishers.

VMware’s Presence on Crunchbase

Yes, VMware has an official profile on Crunchbase, which can be accessed here: https://www.crunchbase.com/organization/vmware.

VMware’s Presence on LinkedIn

Yes, VMware maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/vmware.

Cybersecurity Incidents Involving VMware

As of December 16, 2025, Rankiteo reports that VMware has experienced 13 cybersecurity incidents.

Number of Peer and Competitor Companies

VMware has an estimated 27,783 peer or competitor companies worldwide.

What types of cybersecurity incidents have occurred at VMware ?

Incident Types: The types of cybersecurity incidents that have occurred include Ransomware, Breach, Vulnerability and Cyber Attack.

What was the total financial impact of these incidents on VMware ?

Total Financial Loss: The total financial loss from these incidents is estimated to be $0.

How does VMware detect and respond to cybersecurity incidents ?

Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with patches available, and law enforcement notified with yes, and enhanced monitoring with monitoring for risky logins and unauthorized account misuse, and and third party assistance with google threat intelligence group (gitg), third party assistance with mandiant, third party assistance with nviso (for windows variants), and containment measures with scanner script for *nix-based appliances (mandiant), containment measures with yara rule (g_apt_backdoor_brickstorm_3), and incident response plan activated with yes (broadcom patch release), and third party assistance with nviso (vulnerability reporting and poc), third party assistance with google mandiant (threat actor analysis), and containment measures with patch release for cve-2025-41244, containment measures with previous patches for cve-2025-22224, cve-2025-22225, cve-2025-22226 (march 2024), containment measures with nsx vulnerabilities patched (november 2024), and incident response plan activated with cisa's binding operational directive (bod) 22-01 enforcement, and third party assistance with broadcom (vmware) security patches, third party assistance with nviso (vulnerability research), third party assistance with google mandiant (threat actor analysis), and containment measures with patch application (mandated within 3 weeks for fceb agencies), containment measures with discontinuing use of vulnerable products if patches unavailable, and remediation measures with applying vendor-provided mitigations, remediation measures with enhanced monitoring for exploitation attempts, and communication strategy with cisa advisory to federal agencies and private sector, communication strategy with broadcom's public disclosure of exploitation, and enhanced monitoring with recommended for all organizations, and and third party assistance with nviso, third party assistance with google mandiant, and containment measures with patching vmware tools (12.4.9 for windows 32-bit, 12.5.4 for general; open-vm-tools for linux), containment measures with disabling sdmp if patching is not feasible, and remediation measures with applying security updates by november 20, 2025 (cisa deadline), remediation measures with monitoring for signs of exploitation, and communication strategy with cisa advisory via kev catalog, communication strategy with public disclosure by security researchers (e.g., bleepingcomputer, techradar), and enhanced monitoring with recommended for systems running vmware tools with sdmp, and network segmentation with recommended for organizations using oracle e-business suite, and enhanced monitoring with recommended: review security logs for unauthorized access, deploy edr solutions, and and third party assistance with mandiant (google-owned cybersecurity firm), and containment measures with oracle security patches (cve-2025-61882, cve-2025-21884), and remediation measures with patch application for oracle ebs vulnerabilities, and communication strategy with oracle security alerts to customers, communication strategy with public disclosure via media..

Incident Details

Can you provide details on each incident ?

Incident : Data Breach

Exposure

Impact

Title: Symantec Data Breach

Description: Security firm Symantec was attacked by a hacker in February 2021, resulting in the extraction of data including passwords and a list of Symantec clients, including government agencies.

Date Detected: 2021-02-01

Type: Data Breach

Incident : Vulnerability Exploit

Exposure

Impact

Title: Symantec and Norton Vulnerabilities Identified by Tavis Ormandy

Type: Vulnerability Exploit

Attack Vector: Executable File

Vulnerability Exploited: File Decompression in Kernel

Motivation: Data Theft

Incident : Ransomware

Exposure

Impact

Title: SEXi Ransomware Attack on VMware ESXi Servers

Type: Ransomware

Attack Vector: Exploitation of vulnerabilities in VMware ESXi servers

Vulnerability Exploited: Critical vulnerabilities within the ESXi platform

Threat Actor: SEXi ransomware (rebranded as APT INC)

Motivation: Disruption of services and potential data leakage

Incident : Vulnerability

Exposure

Impact

Title: VMware VMSA-2025-0006 Privilege Escalation Vulnerability

Type: Vulnerability

Attack Vector: Local Access

Vulnerability Exploited: CVE-2025-22231

Motivation: Privilege Escalation

Incident : Ransomware

Exposure

Impact

Title: Exploitation of Kickidler for Ransomware Deployment

Type: Ransomware

Attack Vector: Poisoned ad on Google Ads networkTrojanized RVToolsSMOKEDHAM backdoor

Vulnerability Exploited: Kickidler employee monitoring tool

Threat Actor: QilinHunters International

Motivation: Obtain login credentials and deploy ransomware encryptors

Incident : Espionage

Exposure

Impact

Title: BRICKSTORM Backdoor Campaign Targeting US Legal, Tech, and SaaS Firms

Description: Chinese-aligned threat actors (UNC5221) deployed the BRICKSTORM backdoor in intrusion campaigns targeting US legal and tech firms, SaaS providers, and outsourcing companies since at least March 2025. The attacks exploited zero-day vulnerabilities in network appliances (e.g., VMware vCenter, ESXi hosts) to establish persistence, escalate privileges (via MFA bypass, credential harvesting, and VM cloning), and exfiltrate emails of key individuals. The backdoor communicates via WebSockets to a hardcoded C2 server and supports file manipulation, command execution, and SOCKS relaying. Dwell time averaged 393 days, often exceeding log retention periods.

Date Detected: 2024-04-01

Date Publicly Disclosed: 2025-09-24

Type: Espionage

Attack Vector: Exploitation of Zero-Day VulnerabilitiesBackdoor (BRICKSTORM)Credential HarvestingMFA BypassVM Cloning

Vulnerability Exploited: Zero-Day in Network Appliances (e.g., VMware vCenter, ESXi)Microsoft Entra ID Enterprise Applications (mail.read, full_access_as_app scopes)

Threat Actor: UNC5221Silk Typhoon (disputed as same group by some vendors)

Motivation: EspionageDevelopment of Zero-Day ExploitsPivoting to Downstream VictimsData Exfiltration (Emails of Key Individuals)

Incident : Privilege Escalation

Exposure

Impact

Title: Broadcom Patches High-Severity VMware Aria Operations and VMware Tools Privilege Escalation Vulnerability (CVE-2025-41244) Exploited by UNC5174

Description: Broadcom has patched a high-severity privilege escalation vulnerability (CVE-2025-41244) in its VMware Aria Operations and VMware Tools software, exploited in zero-day attacks since October 2024. The vulnerability allows unprivileged local attackers to escalate privileges to root-level code execution by staging a malicious binary in broadly-matched regex paths (e.g., /tmp/httpd). The attacks have been linked to the Chinese state-sponsored threat actor UNC5174, a contractor for China's Ministry of State Security (MSS). NVISO released a proof-of-concept exploit demonstrating the flaw's exploitation.

Date Detected: 2024-05-01

Date Publicly Disclosed: 2024-11-05

Type: Privilege Escalation

Attack Vector: LocalMalicious Binary StagingService Discovery Abuse

Vulnerability Exploited: CVE-2025-41244 (VMware Aria Operations and VMware Tools Privilege Escalation)

Threat Actor: UNC5174 (Chinese state-sponsored, linked to Ministry of State Security - MSS)

Motivation: EspionageFinancial Gain (selling network access)Cyber Warfare

Incident : Privilege Escalation

Exposure

Impact

Title: Exploitation of CVE-2025-41244 in VMware Aria Operations and VMware Tools by UNC5174

Description: CISA warned U.S. government agencies about active exploitation of CVE-2025-41244, a high-severity privilege escalation vulnerability in Broadcom's VMware Aria Operations and VMware Tools. The flaw, patched a month prior, allows local attackers with non-administrative privileges to escalate to root on a VM managed by Aria Operations with SDMP enabled. The Chinese state-sponsored threat actor UNC5174 has been exploiting this vulnerability since mid-October 2024, targeting U.S. defense contractors, UK government entities, and Asian institutions. CISA mandated federal agencies to patch within three weeks (by November 20, 2025) under BOD 22-01.

Date Detected: 2024-10-01T00:00:00Z

Date Publicly Disclosed: 2025-10-10T00:00:00Z

Type: Privilege Escalation

Attack Vector: Local AttackExploitation of Vulnerable Software (VMware Aria Operations/Tools)Credential-Based & Credential-Less Modes

Vulnerability Exploited: CVE-2025-41244

Threat Actor: UNC5174

Motivation: EspionageFinancial Gain (selling network access)State-Sponsored Activities

Incident : Privilege Escalation

Exposure

Impact

Title: Exploitation of CVE-2025-41244 in VMware Aria Operations and VMware Tools by UNC5174

Description: CISA added CVE-2025-41244 (a local privilege escalation vulnerability in VMware Aria Operations and VMware Tools with SDMP enabled) to its KEV catalog, mandating patching by November 20, 2025. The vulnerability was exploited by Chinese state-sponsored group UNC5174 for espionage targeting Western and Asian institutions, including US defense contractors, UK government agencies, and Asian organizations. The bug allows a local non-administrative actor to escalate privileges to root on a vulnerable VM. Proof-of-concept (POC) code was released by NVISO, and the vulnerability has been actively exploited since at least mid-October 2024.

Date Detected: 2024-10-01

Type: Privilege Escalation

Attack Vector: LocalPrivilege Escalation via VMware Tools with SDMP

Vulnerability Exploited: CVE-2025-41244

Threat Actor: UNC5174Houken (possibly linked)

Motivation: EspionageState-Sponsored Cyber Operations

Incident : ransomware

Exposure

Impact

Title: Ransomware Attack on Business Systems House (BSH) Leading to Broadcom Employee Data Theft

Description: A ransomware attack on Business Systems House (BSH), a Middle Eastern partner of payroll provider ADP, resulted in the theft of Broadcom employee data in September 2024. The data was leaked online in December 2024, but Broadcom was not informed until May 2025. The El Dorado ransomware group claimed responsibility. The breach occurred during Broadcom's transition away from ADP and BSH as payroll providers.

Date Detected: 2024-09

Date Publicly Disclosed: 2025-05

Type: ransomware

Attack Vector: third-party vendor (BSH, a regional partner of ADP)

Threat Actor: El Dorado ransomware group

Motivation: financial gaindata theft

Incident : ransomware

Exposure

Impact

Title: Cl0p Ransomware Gang Claims Breach of Broadcom via Zero-Day in Oracle E-Business Suite

Description: The Cl0p ransomware gang has publicly claimed responsibility for breaching Broadcom, a leading semiconductor and infrastructure software company. The attackers allegedly exploited an unpatched zero-day vulnerability in Oracle E-Business Suite to gain initial access. The incident follows a pattern of Cl0p targeting high-value enterprise systems using zero-day and known vulnerabilities. Broadcom has not issued an official statement, and the claim remains unverified by independent security researchers. The vulnerability allows arbitrary code execution, persistent access, and lateral movement across corporate networks. Cl0p is known for combining zero-day exploitation with credential theft and data exfiltration before deploying ransomware.

Type: ransomware

Attack Vector: zero-day vulnerability in Oracle E-Business Suitearbitrary code executionlateral movementcredential theftdata exfiltration

Vulnerability Exploited: Unpatched zero-day vulnerability in Oracle E-Business Suite (arbitrary code execution)

Threat Actor: Cl0p ransomware gang

Motivation: financial gain (ransomware)data theft for extortiondisruption of high-value enterprise targets

Incident : Ransomware

Exposure

Impact

Title: Cl0p Exploits Zero-Day Vulnerabilities in Oracle E-Business Suite Leading to Massive Data Breaches

Description: The cybercriminal group Cl0p exploited two zero-day vulnerabilities (CVE-2025-61882 and CVE-2025-21884) in Oracle’s E-Business Suite (EBS), leading to data breaches in over 100 companies, including Broadcom, Estée Lauder, Mazda, and Canon. The group demanded significant ransom payments, threatening to leak or sell exfiltrated data if unpaid. Oracle issued security patches, but the attacks had already compromised sensitive corporate and customer data across multiple industries and geographies.

Date Detected: 2023-09-01

Date Publicly Disclosed: 2023-11-20

Type: Ransomware

Attack Vector: Zero-Day Exploit (CVE-2025-61882, CVE-2025-21884)Unauthenticated HTTP RequestsData Exfiltration

Threat Actor: Cl0p (Clop)

Motivation: Financial Gain (Ransomware Extortion)

What are the most common types of attacks the company has faced ?

Common Attack Types: The most common types of attacks the company has faced is Ransomware.

How does the company identify the attack vectors used in incidents ?

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Executable File, Poisoned ad on Google Ads network, Social engineering, Zero-Day Exploits in Network Appliances, Exploitation of CVE-2025-41244 (privilege escalation via /tmp/httpd)Previous exploits: CVE-2023-46747 (F5 BIG-IP), CVE-2024-1709 (ConnectWise ScreenConnect), CVE-2025-31324 (NetWeaver Visual Composer), Exploitation of CVE-2025-41244 on vulnerable VMware systems, VMware Tools with SDMP enabledLocal privilege escalation on compromised VMs, unpatched zero-day vulnerability in Oracle E-Business Suite, Zero-day vulnerabilities in Oracle EBS (CVE-2025-61882 and CVE-2025-21884).

Impact of the Incidents

What was the impact of each incident ?

Incident : Data Breach SYM1336271222

Data Compromised: Passwords, List of symantec clients, Government agencies, List of clients using symantec's cloudsoc services, Account managers, Account numbers

Incident : Vulnerability Exploit SYM44121823

Systems Affected: Symantec Enterprise Products

Incident : Ransomware VMW000072224

Data Compromised: Potentially sensitive customer data

Systems Affected: VMware ESXi servers

Downtime: Significant disruptions to services

Incident : Vulnerability VMW806040125

Data Compromised: Potential unauthorized data access

Systems Affected: VMware Aria OperationsCloud FoundationTelco Cloud platforms

Downtime: Potential service disruptions

Incident : Ransomware VMW222051225

Data Compromised: Login credentials of enterprise administrators

Systems Affected: VMware ESXi infrastructure

Incident : Espionage VMW1132111092525

Data Compromised: Emails of key individuals, Files from email mailboxes

Systems Affected: VMware vCenter ServersESXi HostsNetwork AppliancesMicrosoft Entra ID Enterprise Applications

Operational Impact: Persistence via init.d/rc.local/systemdLateral Movement via Credential ReusePrivilege Escalation via Servlet Filter Injection

Brand Reputation Impact: Potential reputational damage due to espionage and data exfiltration

Incident : Privilege Escalation BRO4592445093025

Systems Affected: VMware Aria Operations (credential-based mode)VMware Tools (credential-less mode)

Operational Impact: Potential root-level code execution on vulnerable VMs, leading to full system compromise

Brand Reputation Impact: High (zero-day exploitation by state-sponsored actor, multiple high-profile vulnerabilities in 2024)

Incident : Privilege Escalation VMW3002130103125

Systems Affected: VMware Aria Operations (with SDMP enabled)VMware Tools on vulnerable VMs

Operational Impact: Potential root-level code execution on compromised VMsRisk of lateral movement within federal networks

Brand Reputation Impact: Potential reputational damage to U.S. federal agencies and Broadcom/VMware

Legal Liabilities: Non-compliance with BOD 22-01 for unpatched FCEB agencies

Incident : Privilege Escalation VMW2892328103125

Systems Affected: VMware Aria OperationsVMware Tools (with SDMP enabled)

Operational Impact: Privilege escalation to rootPotential unauthorized access to sensitive systems

Brand Reputation Impact: Potential reputational damage to VMwareTrust erosion in affected institutions

Incident : ransomware BRO3362533111725

Data Compromised: Broadcom employee data

Brand Reputation Impact: negative (ripples through tech and cybersecurity community)

Identity Theft Risk: potential (employee data exposed)

Incident : ransomware BRO0893008112125

Systems Affected: Oracle E-Business Suitesupply chain operationsfinancial systemscustomer datamanufacturing operationsresearch data

Operational Impact: potential disruption of manufacturing operationssupply chain interruptionsglobal infrastructure risks

Brand Reputation Impact: high (targeting a $300B+ company)potential loss of trust in supply chain security

Legal Liabilities: potential regulatory compliance violations (e.g., data protection laws)

Incident : Ransomware BRO3105131112625

Systems Affected: Oracle E-Business Suite (EBS) versions 12.2.3–12.2.14

Operational Impact: Significant (data exfiltration, potential system compromise)

Brand Reputation Impact: High (public disclosure of breaches, ransom demands)

Identity Theft Risk: High (PII and sensitive corporate data exfiltrated)

What is the average financial loss per incident ?

Average Financial Loss: The average financial loss per incident is $0.00.

What types of data are most commonly compromised in incidents ?

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Passwords, List Of Symantec Clients, Government Agencies, List Of Clients Using Symantec'S Cloudsoc Services, Account Managers, Account Numbers, , Sensitive customer data, Login credentials, Credentials, Browser Data, Cookies, Sensitive Information, , Emails, Email Attachments/Files, , Employee Data, , Potential: Corporate Data (Supply Chain, Financial, Customer), Intellectual Property (Research Data), , Corporate Data, Customer Data, Sensitive Business Information and .

Which entities were affected by each incident ?

Incident : Data Breach SYM1336271222

Entity Name: Symantec

Entity Type: Security Firm

Industry: Cybersecurity

Incident : Vulnerability Exploit SYM44121823

Entity Name: Symantec

Entity Type: Company

Industry: Cybersecurity

Incident : Ransomware VMW000072224

Entity Name: VMware

Entity Type: Organization

Industry: Technology

Incident : Vulnerability VMW806040125

Entity Name: VMware

Entity Type: Organization

Industry: Technology

Incident : Ransomware VMW222051225

Entity Type: Enterprises

Incident : Espionage VMW1132111092525

Entity Type: Legal Firms, Tech Firms, SaaS Providers, Outsourcing Companies

Industry: Legal, Technology, Software-as-a-Service (SaaS), Outsourcing

Location: United States (primary target)

Incident : Espionage VMW1132111092525

Entity Type: European Organizations

Location: Europe

Incident : Privilege Escalation BRO4592445093025

Entity Name: Broadcom (VMware)

Entity Type: Technology Corporation

Industry: Software/Cloud Infrastructure

Location: United States (Global Operations)

Size: Large Enterprise

Incident : Privilege Escalation BRO4592445093025

Entity Name: U.S. Defense Contractors (via UNC5174 access sales)

Entity Type: Private/Government Contractors

Industry: Defense

Location: United States

Incident : Privilege Escalation BRO4592445093025

Entity Name: UK Government Entities (via UNC5174 access sales)

Entity Type: Government

Industry: Public Sector

Location: United Kingdom

Incident : Privilege Escalation BRO4592445093025

Entity Name: Asian Institutions (via UNC5174 access sales)

Entity Type: Government/Private

Industry: Multiple Sectors

Location: Asia

Incident : Privilege Escalation BRO4592445093025

Entity Name: U.S. and Canadian Institutions (via CVE-2024-1709 exploitation)

Entity Type: Multiple

Industry: Multiple Sectors

Location: United States, Canada

Customers Affected: Hundreds (per February 2024 attacks)

Incident : Privilege Escalation VMW3002130103125

Entity Name: U.S. Federal Civilian Executive Branch (FCEB) Agencies

Entity Type: Government

Industry: Public Sector

Location: United States

Incident : Privilege Escalation VMW3002130103125

Entity Name: U.S. Defense Contractors

Entity Type: Private Sector

Industry: Defense

Location: United States

Incident : Privilege Escalation VMW3002130103125

Entity Name: UK Government Entities

Entity Type: Government

Industry: Public Sector

Location: United Kingdom

Incident : Privilege Escalation VMW3002130103125

Entity Name: Asian Institutions (unspecified)

Location: Asia

Incident : Privilege Escalation VMW2892328103125

Entity Name: Federal Civilian Executive Branch (FCEB) Agencies (US)

Entity Type: Government

Industry: Public Sector

Location: United States

Incident : Privilege Escalation VMW2892328103125

Entity Name: US Defense Contractors

Entity Type: Private Sector

Industry: Defense

Location: United States

Incident : Privilege Escalation VMW2892328103125

Entity Name: UK Government Agencies

Entity Type: Government

Industry: Public Sector

Location: United Kingdom

Incident : Privilege Escalation VMW2892328103125

Entity Name: Asian Institutions (unspecified)

Entity Type: Government, Private Sector

Location: Asia

Incident : Privilege Escalation VMW2892328103125

Entity Name: French Government Agencies

Entity Type: Government

Industry: Public Sector

Location: France

Incident : Privilege Escalation VMW2892328103125

Entity Name: Commercial Entities (Telcos, Finance, Transportation)

Entity Type: Private Sector

Industry: Telecommunications, Financial Services, Transportation

Location: FranceGlobal

Incident : Privilege Escalation VMW2892328103125

Entity Name: VMware (Broadcom)

Entity Type: Private Sector

Industry: Technology

Location: Global

Size: Large Enterprise

Incident : ransomware BRO3362533111725

Entity Name: Broadcom Inc.

Entity Type: multinational corporation

Industry: semiconductor, infrastructure software

Location: global (HQ in San Jose, California, USA)

Incident : ransomware BRO3362533111725

Entity Name: Business Systems House (BSH)

Entity Type: regional payroll service provider

Industry: payroll services

Location: Middle East

Customers Affected: Broadcom employees (data compromised)

Entity Name: Greater Cleveland RTA

Entity Type: Government Agency

Industry: Transportation

Location: United States

Entity Name: Treet Corp

Entity Type: Corporation

Industry: Manufacturing

Incident : Ransomware BRO3105131112625

Entity Name: University of Phoenix

Entity Type: Educational Institution

Industry: Education

Location: United States

Size: Large

Incident : Ransomware BRO3105131112625

Entity Name: L&L Products

Entity Type: Corporation

Industry: Automotive/Manufacturing

Location: United States

Size: Mid-Large

Incident : Ransomware BRO3105131112625

Entity Name: Worley

Entity Type: Corporation

Industry: Engineering/Consulting

Location: Australia

Entity Name: Greenball

Entity Type: Corporation

Industry: Manufacturing

Incident : Ransomware BRO3105131112625

Entity Name: Sumitomo Chemical

Entity Type: Corporation

Industry: Chemicals

Location: Japan

Size: Large

Incident : Ransomware BRO3105131112625

Entity Name: Aljomaih Automotive Company (AAC)

Entity Type: Corporation

Industry: Automotive

Location: Saudi Arabia

Size: Large

Response to the Incidents

What measures were taken in response to each incident ?

Incident : Vulnerability VMW806040125

Remediation Measures: Patches available

Incident : Espionage VMW1132111092525

Incident Response Plan Activated: True

Third Party Assistance: Google Threat Intelligence Group (Gitg), Mandiant, Nviso (For Windows Variants).

Containment Measures: Scanner Script for *nix-based Appliances (Mandiant)YARA Rule (G_APT_Backdoor_BRICKSTORM_3)

Incident : Privilege Escalation BRO4592445093025

Incident Response Plan Activated: Yes (Broadcom patch release)

Third Party Assistance: Nviso (Vulnerability Reporting And Poc), Google Mandiant (Threat Actor Analysis).

Containment Measures: Patch release for CVE-2025-41244Previous patches for CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 (March 2024)NSX vulnerabilities patched (November 2024)

Incident : Privilege Escalation VMW3002130103125

Incident Response Plan Activated: ["CISA's Binding Operational Directive (BOD) 22-01 enforcement"]

Third Party Assistance: Broadcom (Vmware) Security Patches, Nviso (Vulnerability Research), Google Mandiant (Threat Actor Analysis).

Containment Measures: Patch application (mandated within 3 weeks for FCEB agencies)Discontinuing use of vulnerable products if patches unavailable

Remediation Measures: Applying vendor-provided mitigationsEnhanced monitoring for exploitation attempts

Communication Strategy: CISA advisory to federal agencies and private sectorBroadcom's public disclosure of exploitation

Enhanced Monitoring: Recommended for all organizations

Incident : Privilege Escalation VMW2892328103125

Incident Response Plan Activated: True

Third Party Assistance: Nviso, Google Mandiant.

Containment Measures: Patching VMware Tools (12.4.9 for Windows 32-bit, 12.5.4 for general; open-vm-tools for Linux)Disabling SDMP if patching is not feasible

Remediation Measures: Applying security updates by November 20, 2025 (CISA deadline)Monitoring for signs of exploitation

Communication Strategy: CISA advisory via KEV catalogPublic disclosure by security researchers (e.g., BleepingComputer, TechRadar)

Enhanced Monitoring: Recommended for systems running VMware Tools with SDMP

Incident : ransomware BRO0893008112125

Network Segmentation: ['recommended for organizations using Oracle E-Business Suite']

Enhanced Monitoring: recommended: review security logs for unauthorized access, deploy EDR solutions

Incident : Ransomware BRO3105131112625

Incident Response Plan Activated: True

Third Party Assistance: Mandiant (Google-Owned Cybersecurity Firm).

Containment Measures: Oracle security patches (CVE-2025-61882, CVE-2025-21884)

Remediation Measures: Patch application for Oracle EBS vulnerabilities

Communication Strategy: Oracle security alerts to customersPublic disclosure via media

What is the company's incident response plan?

Incident Response Plan: The company's incident response plan is described as Yes (Broadcom patch release), CISA's Binding Operational Directive (BOD) 22-01 enforcement, , , .

How does the company involve third-party assistance in incident response ?

Third-Party Assistance: The company involves third-party assistance in incident response through Google Threat Intelligence Group (GITG), Mandiant, NVISO (for Windows variants), , NVISO (vulnerability reporting and PoC), Google Mandiant (threat actor analysis), , Broadcom (VMware) security patches, NVISO (vulnerability research), Google Mandiant (threat actor analysis), , NVISO, Google Mandiant, , Mandiant (Google-owned cybersecurity firm), .

Data Breach Information

What type of data was compromised in each breach ?

Incident : Data Breach SYM1336271222

Type of Data Compromised: Passwords, List of symantec clients, Government agencies, List of clients using symantec's cloudsoc services, Account managers, Account numbers

Incident : Ransomware VMW000072224

Type of Data Compromised: Sensitive customer data

Sensitivity of Data: High

Incident : Ransomware VMW222051225

Type of Data Compromised: Login credentials

Sensitivity of Data: High

Incident : Espionage VMW1132111092525

Type of Data Compromised: Emails, Email attachments/files

Sensitivity of Data: High (targeted key individuals within organizations)

Incident : Privilege Escalation VMW2892328103125

Data Exfiltration: Likely (espionage-focused)No specific details provided

Incident : ransomware BRO3362533111725

Type of Data Compromised: Employee data

Sensitivity of Data: high (employee records)

Data Exfiltration: yes (leaked online in December 2024)

Personally Identifiable Information: likely (employee data)

Incident : ransomware BRO0893008112125

Type of Data Compromised: Potential: corporate data (supply chain, financial, customer), Intellectual property (research data)

Sensitivity of Data: high (enterprise resource planning data)potentially confidential (manufacturing, R&D)

Data Exfiltration: claimed by Cl0p (typical tactic before ransomware deployment)

Incident : Ransomware BRO3105131112625

Type of Data Compromised: Corporate data, Customer data, Sensitive business information

Sensitivity of Data: High

What measures does the company take to prevent data exfiltration ?

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Patches available, Applying vendor-provided mitigations, Enhanced monitoring for exploitation attempts, , Applying security updates by November 20, 2025 (CISA deadline), Monitoring for signs of exploitation, , Patch application for Oracle EBS vulnerabilities, .

How does the company handle incidents involving personally identifiable information (PII) ?

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by scanner script for *nix-based appliances (mandiant), yara rule (g_apt_backdoor_brickstorm_3), , patch release for cve-2025-41244, previous patches for cve-2025-22224, cve-2025-22225, cve-2025-22226 (march 2024), nsx vulnerabilities patched (november 2024), , patch application (mandated within 3 weeks for fceb agencies), discontinuing use of vulnerable products if patches unavailable, , patching vmware tools (12.4.9 for windows 32-bit, 12.5.4 for general; open-vm-tools for linux), disabling sdmp if patching is not feasible, , oracle security patches (cve-2025-61882, cve-2025-21884) and .

Ransomware Information

Was ransomware involved in any of the incidents ?

Incident : Ransomware VMW000072224

Ransomware Strain: SEXi (rebranded as APT INC)

Incident : Ransomware VMW222051225

Data Encryption: VMDK virtual hard drives

Incident : ransomware BRO3362533111725

Ransomware Strain: El Dorado

Data Exfiltration: yes

Incident : ransomware BRO0893008112125

Ransomware Strain: Cl0p

Data Encryption: ['likely (standard Cl0p tactic post-exfiltration)']

Data Exfiltration: ['claimed (pre-ransomware deployment)']

Incident : Ransomware BRO3105131112625

Ransom Demanded: True

Ransomware Strain: Cl0p (Clop)

Data Exfiltration: True

Regulatory Compliance

Were there any regulatory violations and fines imposed for each incident ?

Incident : Privilege Escalation VMW3002130103125

Regulations Violated: Binding Operational Directive (BOD) 22-01 (if unpatched),

Regulatory Notifications: CISA's Known Exploited Vulnerabilities (KEV) catalog inclusion

Incident : Privilege Escalation VMW2892328103125

Regulatory Notifications: CISA KEV catalog inclusion (mandatory patching deadline: November 20, 2025)

Lessons Learned and Recommendations

What lessons were learned from each incident ?

Incident : Ransomware VMW000072224

Lessons Learned: Importance of robust security measures to prevent such incidents.

Incident : Espionage VMW1132111092525

Lessons Learned: Threat actors leveraged zero-day vulnerabilities in network appliances lacking EDR support (e.g., VMware vCenter)., Dwell time (avg. 393 days) often exceeded log retention, complicating forensics., BRICKSTORM's self-monitoring (Watcher function) and WebSocket C2 evaded traditional detection., Lateral movement relied on credential reuse from vaults (e.g., Delinea Secret Server) and automated secret stealer tools., Microsoft Entra ID scopes (mail.read, full_access_as_app) were exploited for email access.

Incident : Privilege Escalation BRO4592445093025

Lessons Learned: 1. State-sponsored actors like UNC5174 are increasingly exploiting zero-day vulnerabilities in enterprise software (VMware, F5 BIG-IP, ConnectWise, SAP) for espionage and financial gain. 2. Privilege escalation vulnerabilities in widely used tools (e.g., VMware Aria Operations) can lead to full system compromise if left unpatched. 3. Collaboration with threat intelligence firms (NVISO, Mandiant, Microsoft) is critical for timely detection and mitigation. 4. Regular patching of high-severity vulnerabilities reported by entities like NSA and Microsoft Threat Intelligence is essential to prevent exploitation.

Incident : Privilege Escalation VMW3002130103125

Lessons Learned: Critical importance of timely patching for known exploited vulnerabilities (KEVs), State-sponsored actors leverage privilege escalation flaws for persistent access, Need for cross-sector collaboration (e.g., NVISO, Mandiant, CISA) in threat intelligence sharing

Incident : Privilege Escalation VMW2892328103125

Lessons Learned: State-sponsored actors leverage zero-day vulnerabilities for long-term espionage campaigns., Timely patching is critical to mitigate exploitation, especially for vulnerabilities added to CISA's KEV catalog., Collaboration between security researchers (e.g., NVISO, Mandiant) and government agencies (e.g., CISA) is essential for threat intelligence sharing., Proof-of-concept (POC) code releases can accelerate both defensive and offensive operations.

Incident : ransomware BRO0893008112125

Lessons Learned: Zero-day vulnerabilities in enterprise software (e.g., Oracle E-Business Suite) pose severe risks due to lack of patches at exploitation time., High-value targets (e.g., semiconductor manufacturers) are prioritized by ransomware groups like Cl0p for maximum impact., Proactive measures (e.g., network segmentation, EDR, threat intelligence monitoring) are critical for mitigating zero-day risks., Supply chain and ERP systems are attractive targets due to their central role in business operations.

Incident : Ransomware BRO3105131112625

Lessons Learned: Supplier vulnerabilities in enterprise software (e.g., Oracle EBS) can cascade into large-scale breaches across industries. Proactive patch management and supply chain risk monitoring (e.g., via SCRM platforms like Z2Data) are critical to mitigating third-party risks. Cl0p’s delayed data leak strategy highlights the importance of rapid incident response to prevent public exposure of sensitive data.

What recommendations were made to prevent future incidents ?

Incident : Espionage VMW1132111092525

Recommendations: Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Extend log retention periods to exceed average dwell times (393+ days)., Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly.

Incident : Privilege Escalation BRO4592445093025

Recommendations: Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Review and harden VMware Aria Operations and Tools configurations, especially in credential-less modes., Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors.

Incident : Privilege Escalation VMW3002130103125

Recommendations: Immediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMsImmediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMsImmediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMsImmediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMsImmediately apply patches for CVE-2025-41244 as per vendor guidance, Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Review and update incident response plans for privilege escalation scenarios, Consider network segmentation to limit impact of compromised VMs

Incident : Privilege Escalation VMW2892328103125

Recommendations: Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Monitor systems for signs of privilege escalation or unauthorized root access., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Review and update incident response plans to include scenarios involving state-sponsored espionage.

Incident : ransomware BRO0893008112125

Recommendations: Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement network segmentation to limit lateral movement in case of breach., Deploy endpoint detection and response (EDR) solutions for early threat detection., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Conduct regular vulnerability assessments for critical ERP and supply chain systems., Prepare incident response plans specifically for ransomware and zero-day scenarios.

Incident : Ransomware BRO3105131112625

Recommendations: Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Conduct regular audits of enterprise software for zero-day vulnerabilities., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Evaluate the need for network segmentation to limit lateral movement in case of breaches.

What are the key lessons learned from past incidents ?

Key Lessons Learned: The key lessons learned from past incidents are Importance of robust security measures to prevent such incidents.Threat actors leveraged zero-day vulnerabilities in network appliances lacking EDR support (e.g., VMware vCenter).,Dwell time (avg. 393 days) often exceeded log retention, complicating forensics.,BRICKSTORM's self-monitoring (Watcher function) and WebSocket C2 evaded traditional detection.,Lateral movement relied on credential reuse from vaults (e.g., Delinea Secret Server) and automated secret stealer tools.,Microsoft Entra ID scopes (mail.read, full_access_as_app) were exploited for email access.1. State-sponsored actors like UNC5174 are increasingly exploiting zero-day vulnerabilities in enterprise software (VMware, F5 BIG-IP, ConnectWise, SAP) for espionage and financial gain. 2. Privilege escalation vulnerabilities in widely used tools (e.g., VMware Aria Operations) can lead to full system compromise if left unpatched. 3. Collaboration with threat intelligence firms (NVISO, Mandiant, Microsoft) is critical for timely detection and mitigation. 4. Regular patching of high-severity vulnerabilities reported by entities like NSA and Microsoft Threat Intelligence is essential to prevent exploitation.Critical importance of timely patching for known exploited vulnerabilities (KEVs),State-sponsored actors leverage privilege escalation flaws for persistent access,Need for cross-sector collaboration (e.g., NVISO, Mandiant, CISA) in threat intelligence sharingState-sponsored actors leverage zero-day vulnerabilities for long-term espionage campaigns.,Timely patching is critical to mitigate exploitation, especially for vulnerabilities added to CISA's KEV catalog.,Collaboration between security researchers (e.g., NVISO, Mandiant) and government agencies (e.g., CISA) is essential for threat intelligence sharing.,Proof-of-concept (POC) code releases can accelerate both defensive and offensive operations.Zero-day vulnerabilities in enterprise software (e.g., Oracle E-Business Suite) pose severe risks due to lack of patches at exploitation time.,High-value targets (e.g., semiconductor manufacturers) are prioritized by ransomware groups like Cl0p for maximum impact.,Proactive measures (e.g., network segmentation, EDR, threat intelligence monitoring) are critical for mitigating zero-day risks.,Supply chain and ERP systems are attractive targets due to their central role in business operations.Supplier vulnerabilities in enterprise software (e.g., Oracle EBS) can cascade into large-scale breaches across industries. Proactive patch management and supply chain risk monitoring (e.g., via SCRM platforms like Z2Data) are critical to mitigating third-party risks. Cl0p’s delayed data leak strategy highlights the importance of rapid incident response to prevent public exposure of sensitive data.

What recommendations has the company implemented to improve cybersecurity ?

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Implement phishing-resistant multifactor authentication, Maintain offline backups stored separately from source systems, Deploy application controls to manage software execution and Enhance monitoring for risky logins and unauthorized account misuse.

References

Where can I find more information about each incident ?

Incident : Vulnerability VMW806040125

Source: VMware

Incident : Espionage VMW1132111092525

Source: Google Threat Intelligence Group (GITG)

Date Accessed: 2025-09-24

Incident : Espionage VMW1132111092525

Source: Google Mandiant BRICKSTORM Scanner Script

Incident : Espionage VMW1132111092525

Source: NVISO Report on BRICKSTORM Windows Variants

Date Accessed: 2025-04-01

Incident : Espionage VMW1132111092525

Source: Google Report on BRICKSTORM (April 2024)

Date Accessed: 2024-04-01

Incident : Privilege Escalation BRO4592445093025

Source: BleepingComputer

Date Accessed: 2024-11-05

Incident : Privilege Escalation BRO4592445093025

Source: NVISO Research (Maxime Thiebaut)

Date Accessed: 2024-11-04

Incident : Privilege Escalation BRO4592445093025

Source: Google Mandiant (UNC5174 Analysis)

Incident : Privilege Escalation BRO4592445093025

Source: Broadcom Security Advisory for CVE-2025-41244

Date Accessed: 2024-11-05

Incident : Privilege Escalation BRO4592445093025

Source: Microsoft Threat Intelligence (VMware Zero-Days, March 2024)

Incident : Privilege Escalation VMW3002130103125

Source: CISA Advisory on CVE-2025-41244

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Date Accessed: 2025-10-10

Incident : Privilege Escalation VMW3002130103125

Source: NVISO Research (Maxime Thiebaut) - Proof of Concept

Date Accessed: 2024-10-01

Incident : Privilege Escalation VMW3002130103125

Source: Google Mandiant - UNC5174 Threat Actor Profile

Date Accessed: 2024-12-01

Incident : Privilege Escalation VMW3002130103125

Source: Broadcom Security Advisory for CVE-2025-41244

Date Accessed: 2025-09-10

Incident : Privilege Escalation VMW2892328103125

Source: CISA Known Exploited Vulnerabilities (KEV) Catalog

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Incident : Privilege Escalation VMW2892328103125

Source: BleepingComputer

URL: https://www.bleepingcomputer.com

Incident : Privilege Escalation VMW2892328103125

Source: TechRadar

URL: https://www.techradar.com

Incident : Privilege Escalation VMW2892328103125

Source: NVISO (Proof-of-Concept Release)

Incident : Privilege Escalation VMW2892328103125

Source: Google Mandiant (UNC5174 Analysis)

Incident : ransomware BRO3362533111725

Source: The Register

Incident : ransomware BRO0893008112125

Source: GBHackers (GBH)

Incident : Ransomware BRO3105131112625

Source: U.S. Cybersecurity and Infrastructure Security Agency (CISA)

Incident : Ransomware BRO3105131112625

Source: UK National Cyber Security Centre (NCSC)

Incident : Ransomware BRO3105131112625

Source: Mandiant (Google-owned cybersecurity firm)

Incident : Ransomware BRO3105131112625

Source: Oracle Security Alerts (CVE-2025-61882, CVE-2025-21884)

Incident : Ransomware BRO3105131112625

Source: Z2Data Supplier Risk Analysis

URL: https://www.z2data.com

Where can stakeholders find additional resources on cybersecurity best practices ?

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: VMware, and Source: Federal Bureau of Investigation (FBI)Date Accessed: July 29, 2025, and Source: Cybersecurity and Infrastructure Security Agency (CISA)Date Accessed: July 29, 2025, and Source: Royal Canadian Mounted Police (RCMP)Date Accessed: July 29, 2025, and Source: Australian Signals Directorate’s Australian Cyber Security Centre (ACSC)Date Accessed: July 29, 2025, and Source: Australian Federal Police (AFP)Date Accessed: July 29, 2025, and Source: Canadian Centre for Cyber Security (CCCS)Date Accessed: July 29, 2025, and Source: United Kingdom’s National Cyber Security Centre (NCSC-UK)Date Accessed: July 29, 2025, and Source: Google Threat Intelligence Group (GITG)Date Accessed: 2025-09-24, and Source: Google Mandiant BRICKSTORM Scanner Script, and Source: NVISO Report on BRICKSTORM Windows VariantsDate Accessed: 2025-04-01, and Source: Google Report on BRICKSTORM (April 2024)Date Accessed: 2024-04-01, and Source: BleepingComputerDate Accessed: 2024-11-05, and Source: NVISO Research (Maxime Thiebaut)Date Accessed: 2024-11-04, and Source: Google Mandiant (UNC5174 Analysis), and Source: Broadcom Security Advisory for CVE-2025-41244Date Accessed: 2024-11-05, and Source: Microsoft Threat Intelligence (VMware Zero-Days, March 2024), and Source: CISA Advisory on CVE-2025-41244Url: https://www.cisa.gov/known-exploited-vulnerabilities-catalogDate Accessed: 2025-10-10, and Source: NVISO Research (Maxime Thiebaut) - Proof of ConceptDate Accessed: 2024-10-01, and Source: Google Mandiant - UNC5174 Threat Actor ProfileDate Accessed: 2024-12-01, and Source: Broadcom Security Advisory for CVE-2025-41244Date Accessed: 2025-09-10, and Source: CISA Known Exploited Vulnerabilities (KEV) CatalogUrl: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, and Source: BleepingComputerUrl: https://www.bleepingcomputer.com, and Source: TechRadarUrl: https://www.techradar.com, and Source: NVISO (Proof-of-Concept Release), and Source: Google Mandiant (UNC5174 Analysis), and Source: The Register, and Source: GBHackers (GBH), and Source: U.S. Cybersecurity and Infrastructure Security Agency (CISA), and Source: UK National Cyber Security Centre (NCSC), and Source: Mandiant (Google-owned cybersecurity firm), and Source: Oracle Security Alerts (CVE-2025-61882, CVE-2025-21884), and Source: Z2Data Supplier Risk AnalysisUrl: https://www.z2data.com.

Investigation Status

What is the current status of the investigation for each incident ?

Incident : Espionage VMW1132111092525

Investigation Status: Ongoing (as of September 2025)

Incident : Privilege Escalation BRO4592445093025

Investigation Status: Ongoing (patch released; threat actor activity under monitoring)

Incident : Privilege Escalation VMW3002130103125

Investigation Status: Ongoing (active exploitation confirmed; patching mandated)

Incident : Privilege Escalation VMW2892328103125

Investigation Status: Ongoing (active exploitation reported as of late 2024)

Incident : ransomware BRO3362533111725

Investigation Status: disclosed (May 2025)

Incident : ransomware BRO0893008112125

Investigation Status: unverified (claimed by Cl0p, no official statement from Broadcom; independent verification pending)

Incident : Ransomware BRO3105131112625

Investigation Status: Ongoing (Cl0p’s data leak timeline suggests delayed public exposure)

How does the company communicate the status of incident investigations to stakeholders ?

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Cisa Advisory To Federal Agencies And Private Sector, Broadcom'S Public Disclosure Of Exploitation, Cisa Advisory Via Kev Catalog, Public Disclosure By Security Researchers (E.G., Bleepingcomputer, Techradar), Oracle Security Alerts To Customers and Public Disclosure Via Media.

Stakeholder and Customer Advisories

Were there any advisories issued to stakeholders or customers for each incident ?

Incident : Privilege Escalation BRO4592445093025

Customer Advisories: Broadcom urged customers to apply patches immediately; no detailed advisory provided in the article.

Incident : Privilege Escalation VMW3002130103125

Stakeholder Advisories: Cisa Alert To Fceb Agencies, Broadcom Customer Notifications.

Customer Advisories: Urgent patching recommendations for VMware Aria Operations/Tools users

Incident : Privilege Escalation VMW2892328103125

Stakeholder Advisories: Cisa Kev Advisory, Vmware Security Bulletin (Implied).

Customer Advisories: VMware patch notificationsSecurity researcher disclosures (e.g., NVISO, Mandiant)

Incident : Ransomware BRO3105131112625

Stakeholder Advisories: Oracle Security Alerts Urging Immediate Patching, Mandiant’S Analysis Of Cl0P’S Modus Operandi.

Customer Advisories: Companies advised to monitor for data leaks on Cl0p’s blog or dark web marketplaces

What advisories does the company provide to stakeholders and customers following an incident ?

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Broadcom urged customers to apply patches immediately; no detailed advisory provided in the article., Cisa Alert To Fceb Agencies, Broadcom Customer Notifications, Urgent Patching Recommendations For Vmware Aria Operations/Tools Users, , Cisa Kev Advisory, Vmware Security Bulletin (Implied), Vmware Patch Notifications, Security Researcher Disclosures (E.G., Nviso, Mandiant), , Oracle Security Alerts Urging Immediate Patching, Mandiant’S Analysis Of Cl0P’S Modus Operandi, Companies Advised To Monitor For Data Leaks On Cl0P’S Blog Or Dark Web Marketplaces and .

Initial Access Broker

How did the initial access broker gain entry for each incident ?

Incident : Vulnerability Exploit SYM44121823

Entry Point: Executable File

Incident : Ransomware VMW222051225

Entry Point: Poisoned ad on Google Ads network

Backdoors Established: SMOKEDHAM

High Value Targets: Enterprise administrators

Data Sold on Dark Web: Enterprise administrators

Incident : Espionage VMW1132111092525

Entry Point: Zero-Day Exploits In Network Appliances,

Backdoors Established: ['BRICKSTORM (Go-based backdoor)']

High Value Targets: Emails Of Key Individuals, Delinea Secret Server, Microsoft Entra Id Enterprise Applications,

Data Sold on Dark Web: Emails Of Key Individuals, Delinea Secret Server, Microsoft Entra Id Enterprise Applications,

Incident : Privilege Escalation BRO4592445093025

Entry Point: Exploitation Of Cve-2025-41244 (Privilege Escalation Via /Tmp/Httpd), Previous Exploits: Cve-2023-46747 (F5 Big-Ip), Cve-2024-1709 (Connectwise Screenconnect), Cve-2025-31324 (Netweaver Visual Composer),

Backdoors Established: Likely (based on UNC5174's history of selling network access)

High Value Targets: U.S. Defense Contractors, Uk Government Entities, Asian Institutions, Critical Infrastructure (Uk/Us Via Sap Netweaver Attacks),

Data Sold on Dark Web: U.S. Defense Contractors, Uk Government Entities, Asian Institutions, Critical Infrastructure (Uk/Us Via Sap Netweaver Attacks),

Incident : Privilege Escalation VMW3002130103125

Entry Point: Exploitation Of Cve-2025-41244 On Vulnerable Vmware Systems,

Reconnaissance Period: ['Since at least mid-October 2024 (per NVISO)']

High Value Targets: U.S. Defense Contractors, Uk Government Networks, Asian Institutions,

Data Sold on Dark Web: U.S. Defense Contractors, Uk Government Networks, Asian Institutions,

Incident : Privilege Escalation VMW2892328103125

Entry Point: Vmware Tools With Sdmp Enabled, Local Privilege Escalation On Compromised Vms,

Reconnaissance Period: ['At least since mid-October 2024 (per NVISO)', 'Potentially longer (up to a year, per researchers)']

High Value Targets: Us Defense Contractors, Uk Government Agencies, French Government Agencies, Asian Institutions,

Data Sold on Dark Web: Us Defense Contractors, Uk Government Agencies, French Government Agencies, Asian Institutions,

Incident : ransomware BRO3362533111725

High Value Targets: Broadcom Employee Data,

Data Sold on Dark Web: Broadcom Employee Data,

Incident : ransomware BRO0893008112125

Entry Point: unpatched zero-day vulnerability in Oracle E-Business Suite

Backdoors Established: ['likely (Cl0p tactic for persistence)']

High Value Targets: Broadcom'S Manufacturing Operations, Research Data, Customer Information, Supply Chain Systems,

Data Sold on Dark Web: Broadcom'S Manufacturing Operations, Research Data, Customer Information, Supply Chain Systems,

Incident : Ransomware BRO3105131112625

Entry Point: Zero-Day Vulnerabilities In Oracle Ebs (Cve-2025-61882, Cve-2025-21884),

Reconnaissance Period: Since late September 2023 (pre-exploitation activity)

High Value Targets: Fortune 500 Companies (E.G., Broadcom, Estée Lauder), Multinational Corporations With Oracle Ebs Dependencies,

Data Sold on Dark Web: Fortune 500 Companies (E.G., Broadcom, Estée Lauder), Multinational Corporations With Oracle Ebs Dependencies,

Post-Incident Analysis

What were the root causes and corrective actions taken for each incident ?

Incident : Ransomware VMW222051225

Root Causes: Exploitation of Kickidler tool

Incident : Espionage VMW1132111092525

Root Causes: Exploitation Of Unpatched Zero-Day Vulnerabilities In Network Appliances., Lack Of Edr Support On Targeted Systems (E.G., Vmware Vcenter)., Insufficient Log Retention (Dwell Time Exceeded Retention Periods)., Overprivileged Microsoft Entra Id Applications (Mail.Read, Full Access As App)., Credential Harvesting Via Http Basic Auth And Mfa Bypass Techniques.,

Corrective Actions: Deploy Mandiant’S Scanner Script For Brickstorm Detection., Audit And Restrict Entra Id Application Permissions., Enhance Monitoring For Websocket-Based C2 Traffic (E.G., Wss://Opra1.Oprawh.Workers[.]Dev)., Implement Network Segmentation To Isolate Vmware Environments., Extend Log Retention Policies To At Least 1 Year (To Cover 393-Day Dwell Time).,

Incident : Privilege Escalation BRO4592445093025

Root Causes: Privilege Escalation Vulnerability In Vmware Service Discovery Mechanism (Broad Regex Path Matching)., Insufficient Validation Of Unprivileged User Processes Opening Listening Sockets., Delayed Public Disclosure Of In-The-Wild Exploitation (Attacks Began In October 2024; Patch/Report In November 2024)., Reuse Of Exploit Techniques Across Multiple Vulnerabilities (E.G., Cve-2023-46747, Cve-2024-1709) By Unc5174.,

Corrective Actions: Broadcom Released Patches For Cve-2025-41244 And Related Vmware Nsx Vulnerabilities., Nviso Published Poc To Aid Detection And Mitigation., Organizations Advised To Audit Vmware Environments For Signs Of Exploitation (E.G., Suspicious /Tmp/Httpd Binaries)., Enhanced Monitoring For Unc5174 Ttps (Tactics, Techniques, Procedures) Across Enterprise Software.,

Incident : Privilege Escalation VMW3002130103125

Root Causes: Delayed Patching Of Known Critical Vulnerability (Cve-2025-41244), Insufficient Privilege Separation In Vmware Tools/Aria Operations, State-Sponsored Actor (Unc5174) Leveraging Zero-Day Exploitation Chain,

Corrective Actions: Enforce Bod 22-01 Compliance For Federal Agencies, Accelerate Patch Deployment Timelines For Critical Infrastructure, Enhance Detection Capabilities For Privilege Escalation Attempts, Conduct Threat Hunting For Unc5174 Indicators Of Compromise (Iocs),

Incident : Privilege Escalation VMW2892328103125

Root Causes: Unpatched Vulnerability (Cve-2025-41244) In Vmware Aria Operations And Vmware Tools., Insufficient Monitoring For Privilege Escalation Attempts., State-Sponsored Actors (Unc5174) Leveraging Zero-Day Exploits For Espionage.,

Corrective Actions: Mandatory Patching Deadline (November 20, 2025) For Fceb Agencies., Public Disclosure Of Poc Code To Raise Awareness (Nviso)., Enhanced Collaboration Between Cisa, Vmware, And Security Researchers For Mitigation.,

Incident : ransomware BRO3362533111725

Root Causes: Third-Party Vendor Vulnerability (Bsh), Supply Chain Risk During Transition Period,

Incident : ransomware BRO0893008112125

Root Causes: Use Of Unpatched Enterprise Software (Oracle E-Business Suite) With Zero-Day Vulnerability., Potential Lack Of Network Segmentation Allowing Lateral Movement., Targeting By A Sophisticated Threat Actor (Cl0P) With A History Of Exploiting Zero-Days.,

Incident : Ransomware BRO3105131112625

Root Causes: Unpatched Zero-Day Vulnerabilities In Oracle Ebs (Cve-2025-61882, Cve-2025-21884)., Lack Of Real-Time Monitoring For Unauthenticated Http Requests Targeting Critical Components (Bi Publisher, Configurator Ui)., Supplier Risk Blind Spots In Enterprise Software Supply Chains.,

Corrective Actions: Immediate Application Of Oracle-Provided Security Patches., Enhanced Supplier Risk Assessments Using Scrm Platforms (E.G., Z2Data)., Implementation Of Behavioral Wafs Or Anomaly Detection For Oracle Ebs Environments., Review Of Third-Party Software Dependencies For Similar Vulnerabilities.,

What is the company's process for conducting post-incident analysis ?

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Monitoring for risky logins and unauthorized account misuse, Google Threat Intelligence Group (Gitg), Mandiant, Nviso (For Windows Variants), , Nviso (Vulnerability Reporting And Poc), Google Mandiant (Threat Actor Analysis), , Broadcom (Vmware) Security Patches, Nviso (Vulnerability Research), Google Mandiant (Threat Actor Analysis), , Recommended For All Organizations, , Nviso, Google Mandiant, , Recommended For Systems Running Vmware Tools With Sdmp, , Recommended: Review Security Logs For Unauthorized Access, Deploy Edr Solutions, , Mandiant (Google-Owned Cybersecurity Firm), .

What corrective actions has the company taken based on post-incident analysis ?

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Deploy Mandiant’S Scanner Script For Brickstorm Detection., Audit And Restrict Entra Id Application Permissions., Enhance Monitoring For Websocket-Based C2 Traffic (E.G., Wss://Opra1.Oprawh.Workers[.]Dev)., Implement Network Segmentation To Isolate Vmware Environments., Extend Log Retention Policies To At Least 1 Year (To Cover 393-Day Dwell Time)., , Broadcom Released Patches For Cve-2025-41244 And Related Vmware Nsx Vulnerabilities., Nviso Published Poc To Aid Detection And Mitigation., Organizations Advised To Audit Vmware Environments For Signs Of Exploitation (E.G., Suspicious /Tmp/Httpd Binaries)., Enhanced Monitoring For Unc5174 Ttps (Tactics, Techniques, Procedures) Across Enterprise Software., , Enforce Bod 22-01 Compliance For Federal Agencies, Accelerate Patch Deployment Timelines For Critical Infrastructure, Enhance Detection Capabilities For Privilege Escalation Attempts, Conduct Threat Hunting For Unc5174 Indicators Of Compromise (Iocs), , Mandatory Patching Deadline (November 20, 2025) For Fceb Agencies., Public Disclosure Of Poc Code To Raise Awareness (Nviso)., Enhanced Collaboration Between Cisa, Vmware, And Security Researchers For Mitigation., , Immediate Application Of Oracle-Provided Security Patches., Enhanced Supplier Risk Assessments Using Scrm Platforms (E.G., Z2Data)., Implementation Of Behavioral Wafs Or Anomaly Detection For Oracle Ebs Environments., Review Of Third-Party Software Dependencies For Similar Vulnerabilities., .

Additional Questions

General Information

What was the amount of the last ransom demanded ?

Last Ransom Demanded: The amount of the last ransom demanded was True.

Who was the attacking group in the last incident ?

Last Attacking Group: The attacking group in the last incident were an SEXi ransomware (rebranded as APT INC), QilinHunters International, Scattered Spider (UNC3944, Scatter Swine, Oktapus, Octo Tempest, Storm-0875, Muddled Libra), UNC5221Silk Typhoon (disputed as same group by some vendors), UNC5174 (Chinese state-sponsored, linked to Ministry of State Security - MSS), UNC5174, UNC5174Houken (possibly linked), El Dorado ransomware group, Cl0p ransomware gang and Cl0p (Clop).

Incident Details

What was the most recent incident detected ?

Most Recent Incident Detected: The most recent incident detected was on 2021-02-01.

What was the most recent incident publicly disclosed ?

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2023-11-20.

Impact of the Incidents

What was the highest financial loss from an incident ?

Highest Financial Loss: The highest financial loss from an incident was Hundreds of millions in damages.

What was the most significant data compromised in an incident ?

Most Significant Data Compromised: The most significant data compromised in an incident were passwords, list of Symantec clients, government agencies, list of clients using Symantec's CloudSOC services, account managers, account numbers, , Potentially sensitive customer data, Potential unauthorized data access, Login credentials of enterprise administrators, Credentials, browser data, cookies, sensitive information, Emails of Key Individuals, Files from Email Mailboxes, , Broadcom employee data, and .

What was the most significant system affected in an incident ?

Most Significant System Affected: The most significant system affected in an incident was Symantec Enterprise Products and and VMware Aria OperationsCloud FoundationTelco Cloud platforms and and VMware ESXi hypervisorsSnowflake cloud environmentsSlackMicrosoft TeamsExchange Online and VMware vCenter ServersESXi HostsNetwork AppliancesMicrosoft Entra ID Enterprise Applications and VMware Aria Operations (credential-based mode)VMware Tools (credential-less mode) and VMware Aria Operations (with SDMP enabled)VMware Tools on vulnerable VMs and VMware Aria OperationsVMware Tools (with SDMP enabled) and Oracle E-Business Suitesupply chain operationsfinancial systemscustomer datamanufacturing operationsresearch data and Oracle E-Business Suite (EBS) versions 12.2.3–12.2.14.

Response to the Incidents

What third-party assistance was involved in the most recent incident ?

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was google threat intelligence group (gitg), mandiant, nviso (for windows variants), , nviso (vulnerability reporting and poc), google mandiant (threat actor analysis), , broadcom (vmware) security patches, nviso (vulnerability research), google mandiant (threat actor analysis), , nviso, google mandiant, , mandiant (google-owned cybersecurity firm), .

What containment measures were taken in the most recent incident ?

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Scanner Script for *nix-based Appliances (Mandiant)YARA Rule (G_APT_Backdoor_BRICKSTORM_3), Patch release for CVE-2025-41244Previous patches for CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 (March 2024)NSX vulnerabilities patched (November 2024), Patch application (mandated within 3 weeks for FCEB agencies)Discontinuing use of vulnerable products if patches unavailable, Patching VMware Tools (12.4.9 for Windows 32-bit, 12.5.4 for general; open-vm-tools for Linux)Disabling SDMP if patching is not feasible, Oracle security patches (CVE-2025-61882 and CVE-2025-21884).

Data Breach Information

What was the most sensitive data compromised in a breach ?

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Potentially sensitive customer data, Potential unauthorized data access, government agencies, list of clients using Symantec's CloudSOC services, Emails of Key Individuals, account numbers, Credentials, browser data, cookies, sensitive information, account managers, Login credentials of enterprise administrators, passwords, Files from Email Mailboxes, list of Symantec clients and Broadcom employee data.

Ransomware Information

What was the highest ransom demanded in a ransomware incident ?

Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was True.

Lessons Learned and Recommendations

What was the most significant lesson learned from past incidents ?

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Supply chain and ERP systems are attractive targets due to their central role in business operations., Supplier vulnerabilities in enterprise software (e.g., Oracle EBS) can cascade into large-scale breaches across industries. Proactive patch management and supply chain risk monitoring (e.g., via SCRM platforms like Z2Data) are critical to mitigating third-party risks. Cl0p’s delayed data leak strategy highlights the importance of rapid incident response to prevent public exposure of sensitive data.

What was the most significant recommendation implemented to improve cybersecurity ?

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Deploy application controls to manage software execution, Implement network segmentation to limit lateral movement in case of breach., Deploy behavioral detection rules for privilege escalation attempts via service abuse (e.g., listening sockets opened by unprivileged processes)., Conduct regular audits of enterprise software for zero-day vulnerabilities., Enforce MFA and audit high-privilege accounts (e.g., Entra ID Enterprise Applications)., Monitor for suspicious binary staging in paths like /tmp/httpd or other broadly-matched regex locations., Monitor for signs of UNC5174 activity, including lateral movement and data exfiltration, Enhance monitoring for risky logins and unauthorized account misuse, Prepare incident response plans specifically for ransomware and zero-day scenarios., Apply security patches for Oracle E-Business Suite as soon as they are released., Implement supply chain risk management (SCRM) tools to assess third-party vendor vulnerabilities (e.g., Z2Data)., Maintain offline backups stored separately from source systems, Segment networks to limit lateral movement via credential reuse., Patch zero-day vulnerabilities in VMware and other appliances promptly., Consider network segmentation to limit impact of compromised VMs, Apply Oracle security patches for CVE-2025-61882 and CVE-2025-21884 immediately., Restrict unprivileged user access to critical service discovery mechanisms in VMware environments., Conduct threat hunting for indicators of compromise (IOCs) associated with UNC5174 or Houken., Enhance logging and detection capabilities for VMware environments, particularly those managed by Aria Operations., Prioritize vulnerability management for VMware products in federal and private-sector environments, Monitor dark web markets for potential sales of network access linked to UNC5174 or similar actors., Conduct threat hunting for indicators of UNC5174 activity, including backdoors or sold access credentials., Immediately apply Broadcom's patches for CVE-2025-41244 and related VMware vulnerabilities., Evaluate the need for network segmentation to limit lateral movement in case of breaches., Immediately apply patches for CVE-2025-41244 as per vendor guidance, Implement phishing-resistant multifactor authentication, Conduct regular vulnerability assessments for critical ERP and supply chain systems., Monitor systems for signs of privilege escalation or unauthorized root access., Enhance monitoring for unauthenticated HTTP requests targeting Oracle EBS components., Implement YARA rules or Mandiant’s scanner script for *nix-based systems., Review and update incident response plans for privilege escalation scenarios, Monitor network appliances (e.g., VMware) for unauthorized processes like BRICKSTORM (vami-httpd)., Immediately review security logs for unauthorized access attempts in Oracle E-Business Suite environments., Monitor threat intelligence sources for zero-day disclosures related to enterprise software., Immediately patch VMware Aria Operations and VMware Tools to the latest versions (e.g., VMware Tools 12.4.9/12.5.4, open-vm-tools for Linux)., Deploy endpoint detection and response (EDR) solutions for early threat detection., Extend log retention periods to exceed average dwell times (393+ days)., Review and update incident response plans to include scenarios involving state-sponsored espionage., Develop and test incident response plans for ransomware attacks, including data exfiltration scenarios., Disable SDMP in VMware Aria Operations if patching is not immediately feasible., Review and harden VMware Aria Operations and Tools configurations and especially in credential-less modes..

References

What is the most recent source of information about an incident ?

Most Recent Source: The most recent source of information about an incident are NVISO Research (Maxime Thiebaut), VMware, NVISO Research (Maxime Thiebaut) - Proof of Concept, Microsoft Threat Intelligence (VMware Zero-Days, March 2024), TechRadar, United Kingdom’s National Cyber Security Centre (NCSC-UK), Z2Data Supplier Risk Analysis, Cybersecurity and Infrastructure Security Agency (CISA), Canadian Centre for Cyber Security (CCCS), U.S. Cybersecurity and Infrastructure Security Agency (CISA), Google Mandiant (UNC5174 Analysis), Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), NVISO (Proof-of-Concept Release), Australian Federal Police (AFP), NVISO Report on BRICKSTORM Windows Variants, Broadcom Security Advisory for CVE-2025-41244, CISA Known Exploited Vulnerabilities (KEV) Catalog, Mandiant (Google-owned cybersecurity firm), BleepingComputer, Royal Canadian Mounted Police (RCMP), Federal Bureau of Investigation (FBI), GBHackers (GBH), Oracle Security Alerts (CVE-2025-61882, CVE-2025-21884), Google Mandiant - UNC5174 Threat Actor Profile, CISA Advisory on CVE-2025-41244, Google Mandiant BRICKSTORM Scanner Script, Google Report on BRICKSTORM (April 2024), Google Threat Intelligence Group (GITG), UK National Cyber Security Centre (NCSC) and The Register.

What is the most recent URL for additional resources on cybersecurity best practices ?

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://www.bleepingcomputer.com, https://www.techradar.com, https://www.z2data.com .

Investigation Status

What is the current status of the most recent investigation ?

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.

Stakeholder and Customer Advisories

What was the most recent stakeholder advisory issued ?

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was CISA alert to FCEB agencies, Broadcom customer notifications, CISA KEV advisory, VMware security bulletin (implied), Oracle security alerts urging immediate patching, Mandiant’s analysis of Cl0p’s modus operandi, .

What was the most recent customer advisory issued ?

Most Recent Customer Advisory: The most recent customer advisory issued were an Broadcom urged customers to apply patches immediately; no detailed advisory provided in the article., Urgent patching recommendations for VMware Aria Operations/Tools users, VMware patch notificationsSecurity researcher disclosures (e.g., NVISO, Mandiant) and Companies advised to monitor for data leaks on Cl0p’s blog or dark web marketplaces.

Initial Access Broker

What was the most recent entry point used by an initial access broker ?

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Executable File, unpatched zero-day vulnerability in Oracle E-Business Suite, Poisoned ad on Google Ads network and Social engineering.

What was the most recent reconnaissance period for an incident ?

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Since at least mid-October 2024 (per NVISO), At least since mid-October 2024 (per NVISO)Potentially longer (up to a year, per researchers), Since late September 2023 (pre-exploitation activity).

Post-Incident Analysis

What was the most significant root cause identified in post-incident analysis ?

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Exploitation of Kickidler tool, Exploitation of unpatched zero-day vulnerabilities in network appliances.Lack of EDR support on targeted systems (e.g., VMware vCenter).Insufficient log retention (dwell time exceeded retention periods).Overprivileged Microsoft Entra ID applications (mail.read, full_access_as_app).Credential harvesting via HTTP basic auth and MFA bypass techniques., Privilege escalation vulnerability in VMware service discovery mechanism (broad regex path matching).Insufficient validation of unprivileged user processes opening listening sockets.Delayed public disclosure of in-the-wild exploitation (attacks began in October 2024; patch/report in November 2024).Reuse of exploit techniques across multiple vulnerabilities (e.g., CVE-2023-46747, CVE-2024-1709) by UNC5174., Delayed patching of known critical vulnerability (CVE-2025-41244)Insufficient privilege separation in VMware Tools/Aria OperationsState-sponsored actor (UNC5174) leveraging zero-day exploitation chain, Unpatched vulnerability (CVE-2025-41244) in VMware Aria Operations and VMware Tools.Insufficient monitoring for privilege escalation attempts.State-sponsored actors (UNC5174) leveraging zero-day exploits for espionage., third-party vendor vulnerability (BSH)supply chain risk during transition period, Use of unpatched enterprise software (Oracle E-Business Suite) with zero-day vulnerability.Potential lack of network segmentation allowing lateral movement.Targeting by a sophisticated threat actor (Cl0p) with a history of exploiting zero-days., Unpatched zero-day vulnerabilities in Oracle EBS (CVE-2025-61882, CVE-2025-21884).Lack of real-time monitoring for unauthenticated HTTP requests targeting critical components (BI Publisher, Configurator UI).Supplier risk blind spots in enterprise software supply chains..

What was the most significant corrective action taken based on post-incident analysis ?

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Deploy Mandiant’s scanner script for BRICKSTORM detection.Audit and restrict Entra ID application permissions.Enhance monitoring for WebSocket-based C2 traffic (e.g., wss://opra1.oprawh.workers[.]dev).Implement network segmentation to isolate VMware environments.Extend log retention policies to at least 1 year (to cover 393-day dwell time)., Broadcom released patches for CVE-2025-41244 and related VMware NSX vulnerabilities.NVISO published PoC to aid detection and mitigation.Organizations advised to audit VMware environments for signs of exploitation (e.g., suspicious /tmp/httpd binaries).Enhanced monitoring for UNC5174 TTPs (tactics, techniques, procedures) across enterprise software., Enforce BOD 22-01 compliance for federal agenciesAccelerate patch deployment timelines for critical infrastructureEnhance detection capabilities for privilege escalation attemptsConduct threat hunting for UNC5174 indicators of compromise (IOCs), Mandatory patching deadline (November 20, 2025) for FCEB agencies.Public disclosure of POC code to raise awareness (NVISO).Enhanced collaboration between CISA, VMware, and security researchers for mitigation., Immediate application of Oracle-provided security patches.Enhanced supplier risk assessments using SCRM platforms (e.g., Z2Data).Implementation of behavioral WAFs or anomaly detection for Oracle EBS environments.Review of third-party software dependencies for similar vulnerabilities..

Latest Global CVEs (Not Company-Specific)

Description

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet.

Published

Date

2025-12-15

Updated

Date

2025-12-15

Risk Information

cvss3

Base: 5.3

Severity: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://support.pentaho.com/hc/en-us/articles/41833799577741--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Generation-of-Error-Message-Containing-Sensitive-Information-Versions-before-10-2-0-4-Impacted-CVE-2025-9122

Description

Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.

Published

Date

2025-12-15

Updated

Date

2025-12-15

Risk Information

cvss3

Base: 8.8

Severity: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://support.pentaho.com/hc/en-us/articles/41832536185613--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-4-Impacted-CVE-2025-9121

Description

A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown function in the library /ctcms/libs/Ct_Config.php of the component Backend System Configuration Module. The manipulation of the argument Cj_Add/Cj_Edit results in code injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.

Published

Date

2025-12-15

Updated

Date

2025-12-15

Risk Information

cvss2

Base: 5.8

Severity: LOW

AV:N/AC:L/Au:M/C:P/I:P/A:P

cvss3

Base: 4.7

Severity: LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

cvss4

Base: 5.1

Severity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Description

A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Published

Date

2025-12-15

Updated

Date

2025-12-15

Risk Information

cvss2

Base: 5.8

Severity: LOW

AV:N/AC:L/Au:M/C:P/I:P/A:P

cvss3

Base: 4.7

Severity: LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

cvss4

Base: 5.1

Severity: LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Description

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended.

Published

Date

2025-12-15

Updated

Date

2025-12-15

Risk Information

cvss4

Base: 1.0

Severity: HIGH

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=vmware' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation

Rapid

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network Security

Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)

Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)

Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat Intelligence

Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest reports → View all security reports →

Badge your company to reduce your risk score and your cyber insurance costs!

Badge your company to reduce your risk score and your cyber insurance costs!

VMware Company CyberSecurity Posture

VMware A.I CyberSecurity Scoring

VMware Company CyberSecurity News & History

Attack with significant impact with internal employee data leaks

Attack threatening the organization’s existence

Attack threatening the organization’s existence

Attack with significant impact with customers data leaks

Attack with significant impact with internal employee data leaks

Attack with significant impact with internal employee data leaks

Attack threatening the organization’s existence

Attack threatening the organization’s existence

Attack threatening the organization’s existence

Attack with significant impact with internal employee data leaks

Attack with significant impact with customers data leaks

Attack with significant impact with internal employee data leaks

Broadcom

Broadcom

Broadcom

Broadcom (VMware)

Symantec

Symantec

VMware (Broadcom Inc.)

VMware

VMware

VMware

Broadcom (VMware)

Broadcom (VMware)

VMware

VMware Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

A.I Risk Score Likelihood 3 - 6 - 9 months

Underwriter Stats for VMware

Incidents vs Software Development Industry Average (This Year)

Incidents vs All-Companies Average (This Year)

Incident Types VMware vs Software Development Industry Avg (This Year)

Incident History — VMware (X = Date, Y = Severity)

VMware Company Subsidiaries

VMwareLast updated: N/A

VMware

VMware Similar Companies

Bolt

Cadence

IDEMIA

Symantec

Lazada

Agoda

KPIT

OpenText

Dassault Systèmes

VMware CyberSecurity News

Singulr AI Appoints Former VMware and Dell CIO Bask Iyer as Strategic Advisor

Akira Group Exploits Vulnerabilities, Triggering Surge in Ransomware Attacks on Hyper-V and VMware ESXi

Researchers spot 700 percent increase in hypervisor ransomware attacks

NSA: VMware under attack from rogues in the machine

US, Canada cybersecurity agencies say China-linked hackers stole login data and other sensitive information

China-Nexus Hackers Target VMware vCenter Systems to Deploy Web Shells and Malware Implants

China-Nexus Hackers Exploiting VMware vCenter Environments to Deploy Web Shells and Malware Implants

China-Nexus Hackers Target VMware vCenter for Malicious Exploits

CISA, NSA sound alarm on Brickstorm backdoor used by China-linked actors targeting VMware, Windows systems

Frequently Asked Questions

VMware CyberSecurity History Information

Official Website of VMware

VMware’s AI-Generated Cybersecurity Score

How many security badges does VMware’ have ?

Does VMware have SOC 2 Type 1 certification ?

Does VMware have SOC 2 Type 2 certification ?

Does VMware comply with GDPR ?

Does VMware have PCI DSS certification ?

Does VMware comply with HIPAA ?

Does VMware have ISO 27001 certification ?

Industry Classification of VMware

Number of Employees at VMware

Subsidiaries Owned by VMware

VMware’s LinkedIn Followers

NAICS Classification of VMware

VMware’s Presence on Crunchbase

VMware’s Presence on LinkedIn

Cybersecurity Incidents Involving VMware