They found entries in VMware server crash logs that showed the "vmdird" service crashing minutes before the attackers deployed the backdoors. The Mandiant researchers said an analysis by both them and VMware fond that the process crashing aligned with the exploitation of CVE-2023-34048.