UNC3886: Chinese Cyberespionage Group Targets VMware ESXi Systems with Zero-Day Vulnerability Exploitation

Mandiant, a cybersecurity company, has recently identified the Chinese cyber espionage group UNC3886 exploiting a zero-day vulnerability in the VMware ESXi hypervisor to escalate privileges on guest virtual machines. The group has been observed deploying malicious vSphere Installation Bundles (VIBs) on ESXi hypervisors to gain command execution, file manipulation, and reverse shell capabilities. UNC3886 is known for targeting technology, defense, and telecommunication organizations in the US and the Asia-Pacific region.

UNC3886’s use of malicious vSphere Installation Bundles (VIBs) to exploit ESXi hypervisors

UNC3886 has been using malicious VIBs to install backdoors on ESXi hypervisors. These VIBs are usually utilized to maintain systems and deploy updates, making it easy for attackers to exploit the vulnerability. The backdoors enable attackers to execute commands, manipulate files, gain reverse shell capabilities, and bypass network segmentation, allowing them to evade security reviews for open listening ports.

Recent attacks involving credential harvesting and lateral movement using VMCI sockets

Mandiant has detected recent attacks that involved UNC3886 harvesting credentials from vCenter Server for all connected ESXi hosts, deploying backdoors using VMCI sockets for lateral movement, and modifying and disabling logging services on compromised systems. The attackers were seen using scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database, enumerate all ESXi hosts and their guest VMs, and modify lists of allowed IPs across all connected ESXi hosts.

Exploiting a VMware Tools zero-day vulnerability to bypass authentication

The Chinese cyber-espionage group also exploited a zero-day vulnerability in VMware Tools to bypass authentication and execute privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs. Tracked as CVE-2023-20867, this vulnerability has a “low severity” rating because its exploitation requires that the attacker has root access to the ESXi server.

Details on CVE-2023-20867 and its low severity rating

CVE-2023-20867 has a low severity rating, which means it is less severe than other vulnerabilities. However, its exploitation, coupled with regaining access to the ESXi host, enables attackers to execute unauthenticated actions with privileged accounts across any virtual machine running below that ESXi host, providing them with unrestricted access to the victim’s network.

UNC3886’s Use of Scripts to Harvest Credentials and Enumerate ESXi Hosts and Guest VMs

UNC3886 is using scripts to harvest credentials from compromised vCenter servers via the connected vPostgreSQL database, enumerate all ESXi hosts and their guest VMs, and modify lists of allowed IPs across all connected ESXi hosts. The malware provides attackers with a new level of persistence that also allows for network segmentation bypass and evasion of security reviews for open listening ports, granting them unrestricted access to the victim’s network.

The Malware’s New Level of Persistence and Network Segmentation Bypass

With access to compromised virtual machines (VMs), the malware provides attackers with a new level of persistence, allowing them to access the infected ESXi host by accessing a VM. This technique enables network segmentation bypass and evasion of security reviews for open listening ports, making it easier for attackers to move laterally throughout the victim’s network.

The Exploitation of CVE-2023-20867 for Unauthenticated Actions with Highest Privileged Accounts

The Chinese cyber espionage group has been exploiting CVE-2023-20867 to execute unauthenticated actions with the highest privileged accounts across any virtual machine running underneath that ESXi host. In conjunction with accessing the ESXi host, UNC3886 can perform unrestricted actions, including command execution and file transfer, without authentication and without leaving any trace.

UNC3886’s History of Exploiting Zero-Day Bugs in Firewall and Virtualization Solutions

UNC3886 is known for exploiting zero-day vulnerabilities in firewall and virtualization solutions in attacks targeting defense, technology, and telecommunications organizations in the US and the Asia-Pacific region. This group has been using installation scripts to deploy malicious VIBs to hosts and exploiting vulnerabilities to execute commands and transfer files from the compromised ESXi host to guest VMs without authentication and leaving no trace.

Use of Installation Scripts and Exploitation of CVE-2023-20867 for Command Execution and File Transfer Without Authentication

UNC3886 has been using malicious installation scripts to deploy VIBs that exploit the vulnerability on hosts and then using CVE-2023-20867 to execute unauthenticated actions with the highest privileged accounts across any virtual machine running underneath that ESXi host. This allows attackers to perform command execution and file transfers without authentication and without leaving a trace, making it difficult for organizations to detect and remediate attacks.

The exploitation of the VMware ESXi zero-day vulnerability by UNC3886 is concerning, as it allows for complete control over guest VMs. Organizations should ensure that their systems are up-to-date with the latest patches and implement strong security measures to prevent such attacks. UNC3886’s history of exploiting zero-day vulnerabilities and deploying malware highlights the importance of being proactive in preventing attacks and having robust incident response plans in place to mitigate the effects of such incidents.

Explore more

Trend Analysis: Dynamics GP to Business Central Transition

In the rapidly evolving landscape of enterprise resource planning (ERP), businesses using Microsoft Dynamics GP face an urgent need to transition to Dynamics 365 Business Central. With mainstream support for Dynamics GP set to end in four years, company leaders must prioritize planning to migrate their systems to avoid compliance risks and increased maintenance expenses. The transition is driven by

Is Your Business Ready for Dynamics 365 Business Central?

Navigating the modern business environment requires solutions that adapt as readily to change as the organizations they support. Dynamics 365 Business Central stands out by offering a comprehensive suite of tools designed for businesses of any size and industry. By utilizing a modular approach, this robust Enterprise Resource Planning (ERP) solution combines flexibility with efficiency, supporting companies as they streamline

Navigating First-Month Hurdles: Is ERP Go-Live Instantly Rewarding?

Implementing an Enterprise Resource Planning (ERP) system such as Microsoft Dynamics 365 Business Central often comes with high expectations of streamlined operations and enhanced efficiencies. However, the initial phase post-implementation can be fraught with unexpected challenges. Businesses anticipate an immediate transformation but swiftly realize that the reality is often more complex. While the allure of instant benefits is strong, the

B2B Marketing Trends: Tech Integration and Data-Driven Strategies

A startling fact: Digital adoption in B2B marketing has increased by 75% in the last three years. This growth raises a compelling question: How is technology reshaping how businesses market to other businesses? The Importance of Transformation The shift from traditional to digital marketing in the B2B sector is nothing short of transformative. As businesses across the globe continue to

Can Humor Transform B2B Marketing Success?

Can humor hold the key to revolutionizing B2B marketing? This question has been swimming under the radar for quite some time, as the very notion seems counterintuitive to traditional norms of professionalism. Yet, a surprising shift reveals humor’s effective role in sectors once deemed strictly serious, urging a reconsideration of its strategic potential. The Serious Business of Humor Historically, B2B