Threat Actors Exploiting Critical VMware Vulnerability

Threat actors are actively exploiting a remote code execution vulnerability (CVE-2022-22954) in VMware Workspace ONE Access and VMware Identity Manager. The vulnerability allows server-side template injection, enabling attackers to execute code and control the targeted server. During exploitation, some attackers deployed cryptocurrency miners and other malicious payloads, including the Linux Tsunami backdoor. Researchers also warned of potential use by ransomware actors for lateral movement.