InfoSecBulletin Cybersecurity for mankind
Mandiant, a prominent cybersecurity firm now part of google cloud, has uncovered the activities of UNC3886, a Chinese cyberespionage group that has been actively exploiting a zero-day vulnerability in VMware ESXi. This vulnerability allows the group to escalate privileges on guest virtual machines, gaining unauthorized access and control.
The initial disclosure of this threat was made in September 2022. UNC3886 has been utilizing malicious vSphere Installation Bundles (VIBs), typically employed for system maintenance and updates, as a means to implant backdoors on ESXi hypervisors. This enables the group to execute commands, manipulate files, and establish reverse shell capabilities.
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
ALSO READ:
Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks
The impact of their malicious actions extends to VMware ESXi hosts, vCenter servers, and Windows virtual machines (VMs). Recent attacks carried out by these cyberspies involved the extraction of credentials from vCenter Server, affecting all connected ESXi hosts. They employed VMCI sockets to deploy backdoors for lateral movement and persistence, while also modifying and disabling logging services on compromised systems.
Furthermore, the group exploited a zero-day vulnerability present in VMware Tools, which bypassed authentication mechanisms and facilitated the execution of privileged commands across various guest VMs running on Windows, Linux, and PhotonOS (vCenter).
Designated as CVE-2023-20867, the severity rating of this vulnerability is classified as “low,” as it necessitates the attacker to possess root access to the ESXi server to exploit it fully. VMware has released an advisory stating that the flaw has been resolved in version 12.2.5 of VMware Tools.
Mandiant’s investigation also revealed the methods employed by UNC3886, including the use of scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database. Additionally, the group modified lists of allowed IPs across all connected ESXi hosts and utilized installation scripts to distribute malicious VIBs to hosts. Their exploitation of CVE-2023-20867 allowed them to execute commands and transfer files between compromised ESXi hosts and guest VMs without authentication, all while leaving no trace.
UNC3886 deployed two backdoors, known as VirtualPita and VirtualGate, using VMCI sockets for lateral movement and sustained persistence. These backdoors grant the attackers a heightened level of persistence, regaining access to infected ESXi hosts by accessing a VM. This approach enables network segmentation bypass and evades security reviews targeting open listening ports.
In conjunction with CVE-2023-20867, the regained access to ESXi hosts enables the attackers to perform unauthenticated actions using the most privileged accounts across any virtual machine running beneath the compromised ESXi host. If a vCenter exists as a virtual machine under the ESXi host, the attacker can proceed to extract all connected vpxuser credentials for all ESXi hosts connected to the vCenter, facilitating further lateral movement within the environment.
UNC3886 is notorious for exploiting zero-day vulnerabilities in firewall and virtualization solutions, primarily targeting defense, technology, and telecommunication organizations in the United States and the Asia-Pacific region.
Related: Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks
Related: Microsoft Warns of AitM Phishing Attacks Against Financial Organizations
