Vali Cyber ZeroLock 5 brings MFA to the hypervisor command line
Vali Cyber released ZeroLock 5 adding CLI-MFA to protect VMware ESX and Linux hypervisors from insider threats and stolen credentials.
ZeroLock 5 introduces CLI-MFA, requiring time-based one-time passwords for file access, program execution, and network operations at the hypervisor command line on ESX and Linux hosts. The release targets ransomware and nation-state actor pivots to virtualization infrastructure, exemplified by ShinyHunters' shinysp1d3r RaaS platform that encrypts VMware ESX environments using stolen credentials and SSH keys. It adds remotely deployable collectors, reusable multi-site deployment blueprints, SIEM forwarding presets, and support for VCF and ESX 6.7+.
- CLI-MFA requires TOTP for governed file, program, and network operations at the hypervisor CLI.
- Collector is now a standalone, remotely deployable service for multi-datacenter enterprises.
- Adds SIEM forwarding presets for Sentinel, Splunk, Sumo Logic, and Google SecOps.
- References Google Cloud forecast and ShinyHunters shinysp1d3r ESX ransomware as threat context.
- Vendors
- Vali CyberVMwareGoogle Cloud
- Products
- ZeroLock 5VMware ESX
- Threat actors
- ShinyHunters
- Malware
- shinysp1d3r
- Organizations
- Vali CyberVMware
From the original article
2 min read at helpnetsecurity.comVali Cyber released ZeroLock 5, a major release focused on closing the two most dangerous gaps in hypervisor security: insider threats and stolen credentials on ESX and Linux hosts. Over the past two years, ransomware operators and nation-state actors alike have shifted their focus from individual endpoints to the hypervisor layer itself.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.