Robuta

https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence
Malware Persistence within ESXi Hypervisors. Learn how attackers use vSphere Installation Bundles ('VIBs") to install backdoors across ESXi hypervisors.
google cloud blogmalware persistenceesxi hypervisorswithinmalicious