inetd[.]pidDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 9 months ago
What the reports say
1 report, newest first · the exact sentence from each-
ESXi Exploitation in the Wild“To activate the configuration, the shellcode reads /var/run/inetd[.]pid, parses the process ID, and sends SIGHUP (signal 1) to inetd, the standard Unix signal to reload configuration.”
Indicators reported together
named in the same reports- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/ESXiExploitToolkit/win_mal_GetShellPlugin.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/ESXiExploitToolkit/win_mal_MAESTRO.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/ESXiExploitToolkit/linux_mal_VSOCKpuppet.yarin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/ESXiExploitToolkit/win_mal_MyDriverSYS.yarin 1 report
- hxxps://github[.]com/huntresslabs/threat-intel/blob/main/2026/2026-01/vm_escape/sigma/proc_creation_win_devcon_disable_vmci_driver.ymlin 1 report
- hxxps://github[.]com/huntresslabs/threat-intel/blob/main/2026/2026-01/vm_escape/sigma/proc_creation_win_kdu_driver_tool_execution.ymlin 1 report
- 37972a232ac6d8c4…8d88956791a7in 1 report
- 4614346fc1ff74f0…a53c86dca25ein 1 report
- c3f8da7599468c11…0cf072469c89in 1 report
- dc5b8f7c6a8a6764…0027444d62bbin 1 report
- 2bc5d02774ac1778…6b68d2c0f94cin 1 report
Copy these 11 indicators · defanged
Also named with it: CVE-2025-22226, CVE-2025-22224, CVE-2025-22225
Thanks — we review every report.