BLOG POSTS
Medusa: A Threat Profile
Aliases Medusa Blog (the group's leak-site branding) Storm-1175 (Microsoft designation for a China-based Medusa affiliate) Get Threat Intel and Security Updates Delivered to Your Inbox. [hubspot_form...
The Problem with Patching: Why the Hypervisor Needs Runtime Security
A Record Year for CVEs Patching was built for a world that gave defenders time. Vulnerabilities were disclosed, vendors shipped fixes, and security teams had days or weeks to test and deploy them before attackers could act. That world...
CVE-2026-47876: Host Code Execution from a Guest VM, and the Control That Constrains It
A critical out-of-bounds write in the VMXNET3 virtual network adapter lets an attacker with local administrative privileges inside a guest VM execute code on the ESXi host. ZeroLock's VMX Lockdown rule is designed to constrain that path....
AI-Assisted Ransomware Attack on ESX: Inside Aurora’s “Vibe Hacking” Campaign
Hacking ESX is as easy as 1, 2, 3. Literally. Between April 8 and May 21, 2026, an operator from the Aurora ransomware group worked through ten victim networks with help from an AI coding assistant. He typed instructions, and the AI...
What Is a CVE? Common Vulnerabilities and Exposures Explained
CVE stands for Common Vulnerabilities and Exposures. In cybersecurity, a CVE is a public catalog entry for a known security flaw in software or hardware, and every entry gets a unique ID that looks like CVE-2021-44228. When someone says...
Aurora: A Threat Profile
Aliases Tracked as Aurora or Aur0ra; no confirmed MITRE group designation or stable alternate operator name at the time of writing. Get Threat Intel and Security Updates Delivered to Your Inbox. [hubspot_form...
Vali Cyber Announces New Integration with CrowdStrike Falcon Next-Gen SIEM
NEW YORK – Fal.Con 2026 – AUGUST 31, 2026 – Vali Cyber today at Fal.Con 2026 announced a new integration with CrowdStrike that enables security data from ZeroLock® to flow into CrowdStrike Falcon® Next-Gen SIEM. The integration enables...
Vali Cyber Launches ZeroLock® 5, Bringing Multi-Factor Authentication to the Hypervisor Command Line
No more unprotected root access: CLI-MFA brings second-factor authentication to the hypervisor CLI and SSH, plus auditable policy lifecycle management, distributed architecture, vCenter integration, and multi-SIEM forwarding. NEW YORK,...
Preemptive Hypervisor Protection, Now Visible in CrowdStrike Falcon Next-Gen SIEM
A ransomware operator who reaches an ESX host does not need long. Enumerate the VMs, kill them, encrypt the datastore. That sequence takes minutes, and it does not care whether anyone is watching. Any security model that depends on an...
ESX Ransomware Protection: Lessons from the Fairlife Attack
Coca-Cola's Fairlife brand generates roughly $4 billion in annual revenue. In July 2026, production was suspended for 11 days after an Anubis ransomware attack encrypted their Nutanix infrastructure. The pattern appears consistent with...
Diving Deep into CVE-2026-59310
For years, cybersecurity strategy has assumed organizations would have time to patch newly disclosed vulnerabilities before attackers could weaponize them. That assumption is rapidly breaking down. In 2025 alone, more than 48,000 CVEs...
Your ESX Environment May Be More Exposed Than You Think
Most organizations running VMware ESX and vCenter have foundational controls in place: patching, restricted administrative access, credential protections, segmentation, and backups. But those controls do not answer the most important...
Anubis: A Threat Profile
Aliases Sphinx — original codename under which early ransomware samples and initial victims were recorded in late 2024, before formal rebranding Anubis__media — operator persona used on the XSS underground forum superSonic — operator...
INC Ransom: A Threat Profile
Aliases GOLD IONIC — Secureworks / Counter Threat Unit tracking name G1032 — MITRE ATT&CK group identifier Profiling Threat Actor Type: Ransomware-as-a-Service (RaaS) operation with double extortion. Whether INC Ransom operates...
How Vali Cyber and VMware Deliver Full-Stack Zero Trust for Federal Cloud Foundation
Vali Cyber + VMware: Zero Trust Protection from Workload to Hypervisor for Agencies Modernizing on VCF Federal civilian agencies and DoD components are modernizing infrastructure with VMware Cloud Foundation (VCF) to support hybrid...
Is Your Infrastructure HIPAA Compliant?
The Hypervisor Gap in Healthcare Security If you run security for a healthcare organization, you've built real protection around the systems HIPAA points to: the electronic health record (EHR), email, the VPN, the cloud apps that handle...