InfoSecBulletin Cybersecurity for mankind
Mandiant, a prominent cybersecurity firm now part of google cloud, has uncovered the activities of UNC3886, a Chinese cyberespionage group that has been actively exploiting a zero-day vulnerability in VMware ESXi. This vulnerability allows the group to escalate privileges on guest virtual machines, gaining unauthorized access and control.
The initial disclosure of this threat was made in September 2022. UNC3886 has been utilizing malicious vSphere Installation Bundles (VIBs), typically employed for system maintenance and updates, as a means to implant backdoors on ESXi hypervisors. This enables the group to execute commands, manipulate files, and establish reverse shell capabilities.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
ALSO READ:
Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks
The impact of their malicious actions extends to VMware ESXi hosts, vCenter servers, and Windows virtual machines (VMs). Recent attacks carried out by these cyberspies involved the extraction of credentials from vCenter Server, affecting all connected ESXi hosts. They employed VMCI sockets to deploy backdoors for lateral movement and persistence, while also modifying and disabling logging services on compromised systems.
Furthermore, the group exploited a zero-day vulnerability present in VMware Tools, which bypassed authentication mechanisms and facilitated the execution of privileged commands across various guest VMs running on Windows, Linux, and PhotonOS (vCenter).
Designated as CVE-2023-20867, the severity rating of this vulnerability is classified as “low,” as it necessitates the attacker to possess root access to the ESXi server to exploit it fully. VMware has released an advisory stating that the flaw has been resolved in version 12.2.5 of VMware Tools.
Mandiant’s investigation also revealed the methods employed by UNC3886, including the use of scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database. Additionally, the group modified lists of allowed IPs across all connected ESXi hosts and utilized installation scripts to distribute malicious VIBs to hosts. Their exploitation of CVE-2023-20867 allowed them to execute commands and transfer files between compromised ESXi hosts and guest VMs without authentication, all while leaving no trace.
UNC3886 deployed two backdoors, known as VirtualPita and VirtualGate, using VMCI sockets for lateral movement and sustained persistence. These backdoors grant the attackers a heightened level of persistence, regaining access to infected ESXi hosts by accessing a VM. This approach enables network segmentation bypass and evades security reviews targeting open listening ports.
In conjunction with CVE-2023-20867, the regained access to ESXi hosts enables the attackers to perform unauthenticated actions using the most privileged accounts across any virtual machine running beneath the compromised ESXi host. If a vCenter exists as a virtual machine under the ESXi host, the attacker can proceed to extract all connected vpxuser credentials for all ESXi hosts connected to the vCenter, facilitating further lateral movement within the environment.
UNC3886 is notorious for exploiting zero-day vulnerabilities in firewall and virtualization solutions, primarily targeting defense, technology, and telecommunication organizations in the United States and the Asia-Pacific region.
Related: Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks
Related: Microsoft Warns of AitM Phishing Attacks Against Financial Organizations
