vpxuser is the account vCenter keeps so it can log in to the ESXi hosts it manages. That step in the chain was pure credential reuse, not an exploit or malware: the management server already holds the credential it needs to do its job [6]. The exploit was upstream, in CVE-2023-34048 on vCenter Server itself [4].
What lands after that is chosen for where the sensors are not. Sygnia found backdoors on both vCenter and the hosts, persistent across reboots, matched to the VIRTUALPITA family by filename, hash and deployment technique [7], plus a Python daemon called autobackup.bin running in the background for remote command execution and file transfer [8]. V2Ray handled tunneling into guest networks [17]. Credentials came out of memory snapshots, domain controllers among them [10]. Sygnia's own read is that the hypervisor and infrastructure layer is where traditional endpoint tooling is ineffective [13].
The response phase got worked on too. Virtual machines were deployed unregistered on multiple hosts, so the management plane held no record of them [12], and payloads were renamed to impersonate forensic tools, which defeats the responder scanning a process list for something that looks wrong [15]. Sygnia says the actor re-compromised assets, switched tooling, dropped fallback backdoors and altered network configurations while containment was under way [3][15]. Eradication on this layer only works if it happens simultaneously across vCenter, the hosts and the appliances, because sequential cleanup reopens the ingress that was just closed.
Two dates carry more weight than the tradecraft. Broadcom patched CVE-2023-34048 in October 2023 [5], and Sygnia published this activity in July 2025, 21 months later [16][1]. The segmentation break used CVE-2022-1388 against F5 load balancers, with web shells left for cross-segment persistence [14], and the guest interaction used CVE-2023-20867 in VMware Tools [9]. All three identifiers are from 2022 and 2023 [2]. Nothing in the chain needed a fresh zero-day in 2025. It needed infrastructure that stays unrebooted and unpatched for long stretches, with little monitoring in place.
On attribution, Sygnia describes shared tooling and targeting with UNC3886, the China-nexus group that has been working edge devices and virtualization since at least 2022, as an overlap rather than an identification [2]. Whether the operators are the same is unresolved in the report. What is settled is the objective: the hypervisor is the target in its own right [1].
