F5
“Junction” malware used to "marshal data into and out of ESXi guest VMs via VSOCK sockets" says F5 Inc.'s customer threat report, obtained by The Stack.
"If compromised keys were stolen, and F5 hasn’t ruled that out, malicious software updates signed by ‘F5’ could be indistinguishable from the real thing."