Threat intelligence / Malware

VIRTUALPITA

[VIRTUALPITA](https://attack.mitre.org/software/S1217) is a passive backdoor with ESXi and Linux vCenter variants capable of command execution, file transfer, and starting and stopping processes. [VIRTUALPITA](https://attack.mitre.org/software/S1217) has been in use since at least 2022 including by [UNC3886](https://attack.mitre.org/groups/G1048) who leveraged malicious vSphere Installation Bundles (VIBs) for install on ESXi hypervisors.(Citation: Google Cloud Threat Intelligence ESXi VIBs 2022)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[VIRTUALPITA](https://attack.mitre.org/software/S1217) is a passive backdoor with ESXi and Linux vCenter variants capable of command execution, file transfer, and starting and stopping processes. [VIRTUALPITA](https://attack.mitre.org/software/S1217) has been in use since at least 2022 including by [UNC3886](https://attack.mitre.org/groups/G1048) who leveraged malicious vSphere Installation Bundles (VIBs) for install on ESXi hypervisors.(Citation: Google Cloud Threat Intelligence ESXi VIBs 2022)

Labels

malware

13 recorded

Relationships

uses

Group

uses

to Boot or Logon Initialization Scripts

Technique

uses

to ESXi Administration Command

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Non-Standard Port

Technique

uses

to Prevent Command History Logging

Technique

uses

Technique

uses

to Service Stop

Technique

uses

Technique

uses

to Virtual Machine Discovery

Technique

2 external

References

mitre-attack

S1217

Google Cloud Threat Intelligence ESXi VIBs 2022

https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence