Mandiant, a cybersecurity company, has recently identified the Chinese cyber espionage group UNC3886 exploiting a zero-day vulnerability in the VMware ESXi hypervisor to escalate privileges on guest virtual machines. The group has been observed deploying malicious vSphere Installation Bundles (VIBs) on ESXi hypervisors to gain command execution, file manipulation, and reverse shell capabilities. UNC3886 is known for targeting technology, defense, and telecommunication organizations in the US and the Asia-Pacific region.
UNC3886’s use of malicious vSphere Installation Bundles (VIBs) to exploit ESXi hypervisors
UNC3886 has been using malicious VIBs to install backdoors on ESXi hypervisors. These VIBs are usually utilized to maintain systems and deploy updates, making it easy for attackers to exploit the vulnerability. The backdoors enable attackers to execute commands, manipulate files, gain reverse shell capabilities, and bypass network segmentation, allowing them to evade security reviews for open listening ports.
Recent attacks involving credential harvesting and lateral movement using VMCI sockets
Mandiant has detected recent attacks that involved UNC3886 harvesting credentials from vCenter Server for all connected ESXi hosts, deploying backdoors using VMCI sockets for lateral movement, and modifying and disabling logging services on compromised systems. The attackers were seen using scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database, enumerate all ESXi hosts and their guest VMs, and modify lists of allowed IPs across all connected ESXi hosts.
Exploiting a VMware Tools zero-day vulnerability to bypass authentication
The Chinese cyber-espionage group also exploited a zero-day vulnerability in VMware Tools to bypass authentication and execute privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs. Tracked as CVE-2023-20867, this vulnerability has a “low severity” rating because its exploitation requires that the attacker has root access to the ESXi server.
Details on CVE-2023-20867 and its low severity rating
CVE-2023-20867 has a low severity rating, which means it is less severe than other vulnerabilities. However, its exploitation, coupled with regaining access to the ESXi host, enables attackers to execute unauthenticated actions with privileged accounts across any virtual machine running below that ESXi host, providing them with unrestricted access to the victim’s network.
UNC3886’s Use of Scripts to Harvest Credentials and Enumerate ESXi Hosts and Guest VMs
UNC3886 is using scripts to harvest credentials from compromised vCenter servers via the connected vPostgreSQL database, enumerate all ESXi hosts and their guest VMs, and modify lists of allowed IPs across all connected ESXi hosts. The malware provides attackers with a new level of persistence that also allows for network segmentation bypass and evasion of security reviews for open listening ports, granting them unrestricted access to the victim’s network.
The Malware’s New Level of Persistence and Network Segmentation Bypass
With access to compromised virtual machines (VMs), the malware provides attackers with a new level of persistence, allowing them to access the infected ESXi host by accessing a VM. This technique enables network segmentation bypass and evasion of security reviews for open listening ports, making it easier for attackers to move laterally throughout the victim’s network.
The Exploitation of CVE-2023-20867 for Unauthenticated Actions with Highest Privileged Accounts
The Chinese cyber espionage group has been exploiting CVE-2023-20867 to execute unauthenticated actions with the highest privileged accounts across any virtual machine running underneath that ESXi host. In conjunction with accessing the ESXi host, UNC3886 can perform unrestricted actions, including command execution and file transfer, without authentication and without leaving any trace.
UNC3886’s History of Exploiting Zero-Day Bugs in Firewall and Virtualization Solutions
UNC3886 is known for exploiting zero-day vulnerabilities in firewall and virtualization solutions in attacks targeting defense, technology, and telecommunications organizations in the US and the Asia-Pacific region. This group has been using installation scripts to deploy malicious VIBs to hosts and exploiting vulnerabilities to execute commands and transfer files from the compromised ESXi host to guest VMs without authentication and leaving no trace.
Use of Installation Scripts and Exploitation of CVE-2023-20867 for Command Execution and File Transfer Without Authentication
UNC3886 has been using malicious installation scripts to deploy VIBs that exploit the vulnerability on hosts and then using CVE-2023-20867 to execute unauthenticated actions with the highest privileged accounts across any virtual machine running underneath that ESXi host. This allows attackers to perform command execution and file transfers without authentication and without leaving a trace, making it difficult for organizations to detect and remediate attacks.
The exploitation of the VMware ESXi zero-day vulnerability by UNC3886 is concerning, as it allows for complete control over guest VMs. Organizations should ensure that their systems are up-to-date with the latest patches and implement strong security measures to prevent such attacks. UNC3886’s history of exploiting zero-day vulnerabilities and deploying malware highlights the importance of being proactive in preventing attacks and having robust incident response plans in place to mitigate the effects of such incidents.