InfoSecBulletin Cybersecurity for mankind
Mandiant, a prominent cybersecurity firm now part of google cloud, has uncovered the activities of UNC3886, a Chinese cyberespionage group that has been actively exploiting a zero-day vulnerability in VMware ESXi. This vulnerability allows the group to escalate privileges on guest virtual machines, gaining unauthorized access and control.
The initial disclosure of this threat was made in September 2022. UNC3886 has been utilizing malicious vSphere Installation Bundles (VIBs), typically employed for system maintenance and updates, as a means to implant backdoors on ESXi hypervisors. This enables the group to execute commands, manipulate files, and establish reverse shell capabilities.
ALSO READ:
Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks
The impact of their malicious actions extends to VMware ESXi hosts, vCenter servers, and Windows virtual machines (VMs). Recent attacks carried out by these cyberspies involved the extraction of credentials from vCenter Server, affecting all connected ESXi hosts. They employed VMCI sockets to deploy backdoors for lateral movement and persistence, while also modifying and disabling logging services on compromised systems.
Furthermore, the group exploited a zero-day vulnerability present in VMware Tools, which bypassed authentication mechanisms and facilitated the execution of privileged commands across various guest VMs running on Windows, Linux, and PhotonOS (vCenter).
Designated as CVE-2023-20867, the severity rating of this vulnerability is classified as “low,” as it necessitates the attacker to possess root access to the ESXi server to exploit it fully. VMware has released an advisory stating that the flaw has been resolved in version 12.2.5 of VMware Tools.
Mandiant’s investigation also revealed the methods employed by UNC3886, including the use of scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database. Additionally, the group modified lists of allowed IPs across all connected ESXi hosts and utilized installation scripts to distribute malicious VIBs to hosts. Their exploitation of CVE-2023-20867 allowed them to execute commands and transfer files between compromised ESXi hosts and guest VMs without authentication, all while leaving no trace.
UNC3886 deployed two backdoors, known as VirtualPita and VirtualGate, using VMCI sockets for lateral movement and sustained persistence. These backdoors grant the attackers a heightened level of persistence, regaining access to infected ESXi hosts by accessing a VM. This approach enables network segmentation bypass and evades security reviews targeting open listening ports.
In conjunction with CVE-2023-20867, the regained access to ESXi hosts enables the attackers to perform unauthenticated actions using the most privileged accounts across any virtual machine running beneath the compromised ESXi host. If a vCenter exists as a virtual machine under the ESXi host, the attacker can proceed to extract all connected vpxuser credentials for all ESXi hosts connected to the vCenter, facilitating further lateral movement within the environment.
UNC3886 is notorious for exploiting zero-day vulnerabilities in firewall and virtualization solutions, primarily targeting defense, technology, and telecommunication organizations in the United States and the Asia-Pacific region.
Related: Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks
Related: Microsoft Warns of AitM Phishing Attacks Against Financial Organizations
