Stealthy cyber spies linked to China compromising virtualization software globally

Sygnia outlines an ongoing, sophisticated cyber-espionage campaign named Fire Ant—associated with UNC3886—that compromises VMware ESXi hypervisors and network infrastructure globally using custom persistent tools that evade EDRs, targeting high-value defense, technology, and telecom organizations and requiring prolonged eradication due to multiple entry vectors and adaptive tooling.