New VMware Attack Vector Goes From Web Shell to Ransomware

Although the scenario uses a web server as the initial compromise point, Sygnia warns that any exposed VM can serve as an entry point, including mail servers, VDI environments, and even security appliances.