UNC3944 Malicious VIB Installation on VMware ESXi

Kaung Khant Ko@kaungkhantko

•updated Sep 4, 2025•1•4•123

Detects the reconfiguration of a virtual machine where a virtual disk (.vmdk) from a different, often critical, VM is attached. This is a key tactic used by threat actors like UNC3944 to perform offline credential theft by mounting a Domain Controller's disk to a staging VM to access the NTDS.dit file.