EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·11d ago·5 min read
ESXi Exploitation in the Wild
TL;DR
Huntress identified a sophisticated intrusion involving VMware ESXi exploits, likely initiated through a compromised SonicWall VPN. The attack was thwarted before it could lead to a ransomware incident.
✦ Why It Matters
Ensure your VPNs are secure to prevent similar intrusions in your environment.
Key Takeaways
- Regularly update and patch VPN software.
- Monitor for unusual access patterns in your network.
- Implement multi-factor authentication for VPN access.
- Conduct security audits to identify vulnerabilities.
Full Summary
In December 2025, Huntress detected an intrusion that utilized VMware ESXi exploits, indicating a significant security threat. Initial access was traced back to a compromised SonicWall VPN, highlighting that even advanced attacks can exploit basic vulnerabilities.
The toolkit analyzed contained Chinese language strings, suggesting it was developed by a well-resourced actor, potentially from a Chinese-speaking region. Notably, the exploit may have been a zero-day, developed over a year prior to VMware's public disclosure.
The Huntress Tactical Response team, along with the Security Operations Center, successfully intervened, preventing a potential ransomware attack. This incident underscores the importance of robust VPN security and proactive threat detection.