It all started with a strange alert inside a guest VM and led investigators down to the hypervisor and beyond.

In this webinar, we’ll present the case study of Fire Ant, a China-nexus threat actor that gained access to virtualization and networking infrastructure by creating multilayered attack kill chains to facilitate access to restricted and segmented network assets within presumed to be isolated environments.

The webinar will cover:

• How Fire Ant exploited vCenter and ESXi vulnerabilities to deploy persistent backdoors.
• The use of advanced stealth techniques, including rootkits, to maintain resilience even during remediation.
• Practical detection and investigation techniques for unmonitored infrastructure.
• Strategic lessons on how incident response must evolve when facing adaptive, nation-state adversaries.

This session is designed for cybersecurity leaders and practitioners. You’ll get a rare look into the reality of fighting an APT beneath the hypervisor, told from the front lines of incident response.