InfoSecBulletin Cybersecurity for mankind
Mandiant, a prominent cybersecurity firm now part of google cloud, has uncovered the activities of UNC3886, a Chinese cyberespionage group that has been actively exploiting a zero-day vulnerability in VMware ESXi. This vulnerability allows the group to escalate privileges on guest virtual machines, gaining unauthorized access and control.
The initial disclosure of this threat was made in September 2022. UNC3886 has been utilizing malicious vSphere Installation Bundles (VIBs), typically employed for system maintenance and updates, as a means to implant backdoors on ESXi hypervisors. This enables the group to execute commands, manipulate files, and establish reverse shell capabilities.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
ALSO READ:
Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks
The impact of their malicious actions extends to VMware ESXi hosts, vCenter servers, and Windows virtual machines (VMs). Recent attacks carried out by these cyberspies involved the extraction of credentials from vCenter Server, affecting all connected ESXi hosts. They employed VMCI sockets to deploy backdoors for lateral movement and persistence, while also modifying and disabling logging services on compromised systems.
Furthermore, the group exploited a zero-day vulnerability present in VMware Tools, which bypassed authentication mechanisms and facilitated the execution of privileged commands across various guest VMs running on Windows, Linux, and PhotonOS (vCenter).
Designated as CVE-2023-20867, the severity rating of this vulnerability is classified as “low,” as it necessitates the attacker to possess root access to the ESXi server to exploit it fully. VMware has released an advisory stating that the flaw has been resolved in version 12.2.5 of VMware Tools.
Mandiant’s investigation also revealed the methods employed by UNC3886, including the use of scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database. Additionally, the group modified lists of allowed IPs across all connected ESXi hosts and utilized installation scripts to distribute malicious VIBs to hosts. Their exploitation of CVE-2023-20867 allowed them to execute commands and transfer files between compromised ESXi hosts and guest VMs without authentication, all while leaving no trace.
UNC3886 deployed two backdoors, known as VirtualPita and VirtualGate, using VMCI sockets for lateral movement and sustained persistence. These backdoors grant the attackers a heightened level of persistence, regaining access to infected ESXi hosts by accessing a VM. This approach enables network segmentation bypass and evades security reviews targeting open listening ports.
In conjunction with CVE-2023-20867, the regained access to ESXi hosts enables the attackers to perform unauthenticated actions using the most privileged accounts across any virtual machine running beneath the compromised ESXi host. If a vCenter exists as a virtual machine under the ESXi host, the attacker can proceed to extract all connected vpxuser credentials for all ESXi hosts connected to the vCenter, facilitating further lateral movement within the environment.
UNC3886 is notorious for exploiting zero-day vulnerabilities in firewall and virtualization solutions, primarily targeting defense, technology, and telecommunication organizations in the United States and the Asia-Pacific region.
Related: Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks
Related: Microsoft Warns of AitM Phishing Attacks Against Financial Organizations
