InfoSecBulletin Cybersecurity for mankind
Mandiant found new ways that UNC3886 uses to attack computer systems. They focus on technologies that don’t have EDR protection and use zero-day vulnerabilities to avoid detection. This shows their advanced capabilities.
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
When CVE-2023-20867 was discovered in VMware’s tools, a diagram (Figure 1) showed the path of attacker activity in the VMware ecosystem (vCenter, ESXi Hypervisors, Virtualized Guest Machines). Mandiant kept researching the deployment of backdoors to vCenter systems with the available evidence.
In late 2023, a pattern was noticed in affected vCenter systems that revealed how the attacker was getting initial access. The VMware service crash logs (/var/log/vMonCoredumper.log) showed the “vmdird” service crashing shortly before attacker backdoors were installed.
Both Mandiant and VMware Product Security analyzed the core dump of “vmdird”. They found that the process crash is related to the exploitation of CVE-2023-34048. This vulnerability, known as the out-of-bounds write vCenter vulnerability, was patched in October 2023. It allows unauthenticated remote command execution on vulnerable systems.
The crashes were seen in several UNC3886 cases from late 2021 to early 2022. This vulnerability was publicly reported and fixed in October 2023. The attacker had around a year and a half to exploit this vulnerability. In most cases, log entries were kept, but the “vmdird” core dumps were deleted. The attacker likely removed the core dumps to hide their actions.
Mandiant recommends VMware users to update to the latest version of vCenter 8.0U2 to fix a vulnerability mentioned in the VMware advisory.
