Anti-forensics and log tampering

Fire Ant outlasted eradication inside segmented VMware estates by living on the hypervisor

Sygnia says the actor pivoted from vCenter into ESXi on stolen vpxuser credentials, left backdoors that survive reboots, and terminated vmsyslogd so the hosts stopped writing an audit trail while containment ran.