A hacking group that usually steals data and then cripples its victims' systems with ransomware instead spent its time quietly taking over a software developer's build and code-signing systems, Kaspersky's ICS CERT reports. The investigators say the operation looked set to become a supply chain attack and appears to have been stopped before it got there.
The group is BO Team, also known as Black Owl, which Kaspersky tracks as an APT. It usually announces its hits on a Telegram channel, much like a hacktivist outfit. This time there was no destruction and no boasting, only persistence. The original report does not name the victim.
Nearly every key system fell
The developer called Kaspersky in June 2025 after spotting SMB connection attempts from accounts that should not have been touching administrators' machines. Responders found that the attackers had seized the domain, servers and network equipment, mail, the virtual environment, the Ansible orchestration system, backups, security tooling, the web servers and the company's DNS zone. Critically, they also held the CI/CD pipeline and the code-signing server.
From an SSH password to the hypervisors
The way in was a Linux terminal server reachable over SSH from the internet, with a service account that allowed password logins. From there the attackers scanned the internal network, apparently with Metasploit, and browsed internal portals through Burp Suite. Their failed attempts to reach blocked websites, recovered from a log they had deleted, included VMware vCenter documentation and a vulnerability database.
That clue led Kaspersky to the hypervisors. The company's vCenter 7.0.3 bundled a library vulnerable to Log4Shell (CVE-2021-44228), and a lab test confirmed the build was exploitable. With root access the attackers read an SSH private key, moved onto the hypervisors, and planted hourly cron backdoors disguised as PostgreSQL and VMware components, with timestamps altered to look years old. One backdoor stays inert until its DNS record is switched away from 127.0.0.1, so activating it needs nothing more than a DNS change. Another unpacks a modified ReverseSSH tool in memory.
Access to the virtual machines' memory and to a GitLab server's private key gave them source code and the key to the Ansible server. On Windows, after a blocked Nanodump attempt, they dumped LSASS with built-in Windows tools on a domain controller running an outdated security product, copied the ntds.dit credential database, and logged in with a domain administrator's Kerberos ticket. Reused administrator passwords then carried them into another domain in the forest. For another recent case of attackers abusing vCenter flaws, see our KEV coverage.
Close the old holes BO Team walked through
Almost every step relied on basic hygiene gaps rather than novel tooling:
- Patch vCenter. A Log4Shell-vulnerable build was still running years after the flaw became public.
- Disable password authentication on internet-facing SSH and remove direct exposure where possible.
- Never store credentials in LDAP comment fields or world-readable scripts, both of which the attackers exploited.
- Audit local administrator groups for forgotten accounts and stop reusing administrator passwords across domains.
- Keep endpoint protection current on domain controllers; an outdated product missed a known dump technique.
- Check /etc/cron.hourly on hypervisors and Linux guests for unexpected entries such as pgcache or 1vmware-timesync.
Indicators
- Hypervisor backdoor pgcache (MD5): 346b04985ec6c5d107ba0ddf32fe7691
- Second-cluster backdoor (MD5): b86690213f0155f7b3b65832301ed932
- Obfuscated loader vmware-toolbox-setdate (MD5): 5aa8c19c897176502cf8d8fc543fafc7
- ReverseSSH payload (MD5): 68957de915e2a58339fa477f8078bdf4
- C2: vmware-timecheck-api[.]nofrillsdns[.]com:443
Whoever controls a vendor's signing key controls what its customers trust, which is why a breach that destroyed nothing could have done more damage than any wiper.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.