Topic: APT malware persistence techniques

Hackers hit US legal sector through unlogged VMware ESX flaw, CrowdStrike says

The group, also known as Clay Typhoon, exploited the vulnerability as a zero-day in early 2026, planting custom malware and registering new MFA devices to maintain hidden access. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Wednesday.