{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/lockbit/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["LockBit","BITWISE SPIDER"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ESXi"],"_cs_severities":["high"],"_cs_tags":["persistence","ransomware","vmware","extortion","lockbit","esxi"],"_cs_type":"threat","_cs_vendors":["VMware"],"content_html":"\u003cp\u003eLocal account creation on VMware ESXi hosts serves as a persistence mechanism that survives session termination. Unauthorized accounts, often created via the Host Client or \u003ccode\u003eesxcli\u003c/code\u003e system commands, are a known precursor to hypervisor-level control, particularly in ransomware campaigns. Organizations should audit account creation events against expected administrative activity.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthorized local accounts provide persistent access to the ESXi hypervisor, enabling potential lateral movement, data exfiltration, or deployment of ransomware by threat actors who have gained initial management access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy log collection for VMware ESXi using the Elastic vSphere integration to ensure visibility into \u003ccode\u003ehostd\u003c/code\u003e and shell execution logs.\u003c/li\u003e\n\u003cli\u003eEstablish a baseline of authorized administrative accounts for all ESXi hosts.\u003c/li\u003e\n\u003cli\u003eMonitor for the creation of local accounts (\u003ccode\u003eesxcli system account add\u003c/code\u003e) or logs indicating an account was created on a host.\u003c/li\u003e\n\u003cli\u003eInvestigate any account creation not tied to documented onboarding or break-glass procedures by identifying the user who performed the action and checking for subsequent assignment of administrative roles.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T08:52:20Z","date_published":"2026-11-03T15:31:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-esxi-account-persistence/","summary":"This brief details the detection of local account creation on VMware ESXi hosts, a technique frequently used by threat actors to establish persistence on hypervisors.","title":"VMware ESXi: Unauthorized local account creation detection","url":"https://feed.craftedsignal.io/briefs/2026-11-esxi-account-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Lockbit","version":"https://jsonfeed.org/version/1.1"}