Sunday , June 22 2025
vmware

Mandiant Warns of VMware ESXi Zero-Day exploiting

Mandiant, a prominent cybersecurity firm now part of google cloud, has uncovered the activities of UNC3886, a Chinese cyberespionage group that has been actively exploiting a zero-day vulnerability in VMware ESXi. This vulnerability allows the group to escalate privileges on guest virtual machines, gaining unauthorized access and control.

The initial disclosure of this threat was made in September 2022. UNC3886 has been utilizing malicious vSphere Installation Bundles (VIBs), typically employed for system maintenance and updates, as a means to implant backdoors on ESXi hypervisors. This enables the group to execute commands, manipulate files, and establish reverse shell capabilities.

Russia detects first SuperCard malware attacks via NFC

Russian cybersecurity experts discovered the first local data theft attacks using a modified version of legitimate near field communication (NFC)...
Read More
Russia detects first SuperCard malware attacks via NFC

Income Property Investments exposes 170,000+ Individuals record

Cybersecurity researcher Jeremiah Fowler discovered an unsecured database with 170,360 records belonging to a real estate company. It contained personal...
Read More
Income Property Investments exposes 170,000+ Individuals record

ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs

GreyNoise found attempts to exploit CVE-2023-28771, a vulnerability in Zyxel's IKE affecting UDP port 500. The attack centers around CVE-2023-28771,...
Read More
ALERT (CVE: 2023-28771)  Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs

CISA Flags Active Exploits in Apple iOS and TP-Link Routers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included two high-risk vulnerabilities in its Known Exploited Vulnerabilities (KEV)...
Read More
CISA Flags Active Exploits in Apple iOS and TP-Link Routers

10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online

SafetyDetectives’ Cybersecurity Team discovered a public post on a clear web forum in which a threat actor claimed to have...
Read More
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online

Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems

WestJet, Canada's second-largest airline, is looking into a cyberattack that has affected some internal systems during its response to the...
Read More
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems

Paraguay 7.4 Million Citizen Records Leaked on Dark Web

Resecurity found 7.4 million records of Paraguayan citizens' personal information leaked on the dark web today. Last week, cybercriminals attempted...
Read More
Paraguay 7.4 Million Citizen Records Leaked on Dark Web

High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation

HashiCorp has revealed a critical vulnerability in its Nomad tool that may let attackers gain higher privileges by misusing the...
Read More
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation

SoftBank: Over 137,000 personal info leaked

SoftBank has disclosed that personal information of more than 137,000 mobile subscribers—covering names, addresses, and phone numbers—might have been leaked...
Read More
SoftBank: Over 137,000 personal info leaked

Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code

Serious security vulnerabilities in Trend Micro Apex One could allow attackers to inject malicious code and elevate their privileges within...
Read More
Alert  Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code

ALSO READ:

Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks

The impact of their malicious actions extends to VMware ESXi hosts, vCenter servers, and Windows virtual machines (VMs). Recent attacks carried out by these cyberspies involved the extraction of credentials from vCenter Server, affecting all connected ESXi hosts. They employed VMCI sockets to deploy backdoors for lateral movement and persistence, while also modifying and disabling logging services on compromised systems.

Furthermore, the group exploited a zero-day vulnerability present in VMware Tools, which bypassed authentication mechanisms and facilitated the execution of privileged commands across various guest VMs running on Windows, Linux, and PhotonOS (vCenter).

Designated as CVE-2023-20867, the severity rating of this vulnerability is classified as “low,” as it necessitates the attacker to possess root access to the ESXi server to exploit it fully. VMware has released an advisory stating that the flaw has been resolved in version 12.2.5 of VMware Tools.

Mandiant’s investigation also revealed the methods employed by UNC3886, including the use of scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database. Additionally, the group modified lists of allowed IPs across all connected ESXi hosts and utilized installation scripts to distribute malicious VIBs to hosts. Their exploitation of CVE-2023-20867 allowed them to execute commands and transfer files between compromised ESXi hosts and guest VMs without authentication, all while leaving no trace.

UNC3886 deployed two backdoors, known as VirtualPita and VirtualGate, using VMCI sockets for lateral movement and sustained persistence. These backdoors grant the attackers a heightened level of persistence, regaining access to infected ESXi hosts by accessing a VM. This approach enables network segmentation bypass and evades security reviews targeting open listening ports.

In conjunction with CVE-2023-20867, the regained access to ESXi hosts enables the attackers to perform unauthenticated actions using the most privileged accounts across any virtual machine running beneath the compromised ESXi host. If a vCenter exists as a virtual machine under the ESXi host, the attacker can proceed to extract all connected vpxuser credentials for all ESXi hosts connected to the vCenter, facilitating further lateral movement within the environment.

UNC3886 is notorious for exploiting zero-day vulnerabilities in firewall and virtualization solutions, primarily targeting defense, technology, and telecommunication organizations in the United States and the Asia-Pacific region.

Related: Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks

Related: Microsoft Warns of AitM Phishing Attacks Against Financial Organizations

 

Check Also

HashiCorp

High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation

HashiCorp has revealed a critical vulnerability in its Nomad tool that may let attackers gain …

Leave a Reply

Your email address will not be published. Required fields are marked *