Unit 42 says the most significant change in tactics is a direct pivot to the virtualization layer: in one case attackers moved from a compromised gateway to the vCenter management appliance, disabled ESXi's execInstalledOnly control and dumped domain credentials offline from a domain controller's VMDK, evading in-guest EDR, and chained the access with Veeam backup flaws (CVE-2023-27532).