The activity was discovered during an incident response investigation where Mandiant observed an attacker leveraging legitimate VMWare tools to send commands to Windows guest machines.
Source: cyware.com