Mandiant VMware vSphere JUL 2025

Scattered Spider has extracted the `NTDS.dit` file by creating volume shadow copies of virtual domain controller disks.

Scattered Spider has used SSH to move laterally in victim environments and to access the vSphere vCenter Server GUI.

Scattered Spider has exfiltrated data from compromised VMware vCenter servers through an established C2 channel using the Teleport remote access tool.

Scattered Spider has used the command shell to upload and install the Teleport remote access tool to a compromised vCenter Server Appliance.

Scattered Spider has enumerated the vSphere Admins and ESX Admins groups in targeted environments.

Scattered Spider has enumerated Active Directory security groups including through the use of ADExplorer, ADRecon.ps1, and Get-ADUser.

Scattered Spider has used compromised credentials for initial access.

Scattered Spider has executed scripts to identify the underlying operating system to ensure it uses the correct installation package for malicious payloads.

Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code, user provisioning, MFA device registration, network diagrams, and shared credentials in documents or spreadsheets.

Scattered Spider has identified vSphere administrator accounts.

Scattered Spider has enumerated legitimate domain accounts which are used in the targeted environment.

Scattered Spider has added accounts to the ESX Admins group to grant them full admin rights in vSphere.

Scattered Spider has downloaded the Teleport remote access tool to compromised VMware vCenter Servers.

Scattered Spider has used BlackCat and DragonForce ransomware to encrypt files including on VMWare ESXi servers.

Scattered Spider has run `SYSTEMD_UNIT_PATH="/lib/systemd/
system/teleport.service` to establish persistence for the Teleport remote access tool.

Scattered Spider has searched for credentials in password vaults and Privileged Access Management (PAM) solutions including HashiCorp Vault.

Scattered Spider has used information from previous data breaches to identify employee names to be used in social engineering.

Scattered Spider has used help desk voice-based phishing and also called employees at target organizations and compelled them to navigate to fake login portals using adversary-in-the-middle toolkits.