Ransomware gang uses SSH tunnels for stealthy VMware ESXi access

Ransomware operators are abusing ESXi's built-in SSH to create stealthy SSH tunnels (e.g., remote port-forwarding/SOCKS) for persistence and lateral movement on VMware ESXi appliances; compromises arise from exploited known flaws or stolen admin credentials, and detection is hampered by distributed ESXi logs and attacker log tampering—organizations are advised to centralize ESXi logs and integrate them into SIEMs to improve visibility.