Hackers Created Rogue VMs to Evade Detection in Recent MITRE Cyber Attack

MITRE reports that the UNC5221 actor exploited two Ivanti Connect Secure zero-days in late December 2023 to bypass MFA, compromise vCenter, and create rogue VMs in a not-for-profit's NERVE environment; the intruder deployed a Golang backdoor (BRICKSTORM) and web shells (BEEFLUSH, BUSHWALK) to execute commands, tunnel SSH to ESXi, and maintain persistence. MITRE published detection guidance and PowerShell scripts (Invoke-HiddenVMQuery, VirtualGHOST) and recommended enabling secure boot to help detect and mitigate rogue VMs.