UNC3944 | VMware - Large File Transfer to or from ESXi Host

R W@shiftyroot

•updated Jul 25, 2025•4•1•119

Detects large data transfers over SSH/SCP (port 22) to or from an ESXi host. This activity is highly suspicious and could indicate an attacker delivering a ransomware payload to the hypervisor or exfiltrating sensitive data (like VMDK files).