ET CURRENT_EVENTS VMware Exploit Campaign Inbound - User-Agent (GoodMoodle-VCFleet/1.0) - Suricata Rule 2071583 (et/open)

ET CURRENT_EVENTS VMware Exploit Campaign Inbound - User-Agent (GoodMoodle-VCFleet/1.0)

7.0.3 5.0SID: 2071583Rev: 1Enabled2 views

Fileemerging-current_events.rules

CreatedAugust 19, 2026

UpdatedAugust 19, 2026

Classificationweb-application-attack

alert http any any -> $HOME_NET any (msg:"ET CURRENT_EVENTS VMware Exploit Campaign Inbound - User-Agent (GoodMoodle-VCFleet/1.0)"; flow:established,to_server; http.user_agent; content:"GoodMoodle-VCFleet|2f|1.0"; reference:url,medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d; classtype:web-application-attack; sid:2071583; rev:1; metadata:affected_product VMware, attack_target Server, tls_state TLSDecrypt, created_at 2026_08_19, deployment Perimeter, confidence High, signature_severity Major, updated_at 2026_08_19; target:dest_ip;)

References

url	medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d

Metadata

affected productVMware

attack targetServer

tls stateTLSDecrypt

created at2026_08_19

deploymentPerimeter

confidenceHigh

signature severityMajor

updated at2026_08_19

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!