VMware

A state-sponsored threat actor compromised MITRE's NERVE network via Ivanti zero-days, then abused VMware VPXUSER privileged account to create rogue VMs directly on ESXi hypervisors, evading vCenter detection. The actor deployed BRICKSTORM backdoor and BEEFLUSH web shell for persistence and C2. This technique bypasses centralized management visibility, allowing stealthy operations.