Chinese statesponsored hackers known as UNC3886 have been abusing a zeroday vulnerability in VMware and Fortinet devices for years, experts have revealed.
A report from Mandiant claims the group used the flaw to deploy malware, steal credentials, and ultimately exfiltrate sensitive data.
The flaw in question is tracked as CVE202334048. It carries a severity score of 9.8/10 (critical), and is described as an outofbounds write flaw that allows remote code execution to attackers with access to vCenter Server. The patch was released in late October 2023.
Regular VMware customers
“UNC3886 has a track record of utilizing zeroday vulnerabilities to complete their mission without being detected, and this latest example further demonstrates their capabilities,” Mandiant explained in the report. With the help of CVE202334048, UNC3886 was allowed to enumerate all ESXi hosts and guest virtual machines on a vulnerable system, and then pull cleartext “vpxuser” credentials for the hosts. The next step was to install VIRTUALPITA and VIRTUALPIE malware, which granted direct access to the compromised endpoints.
From that point, the attackers abused a separate flaw, CVE202320867 (severity score 3.9), to run arbitrary commands and pull sensitive information from the devices.
VMware urges vCenter Server users to apply the latest patch immediately.
The last time we heard of UNC3886 was in September 2022, when researchers spotted the group compromising VMware’s ESXi hypervisors to gain access to virtual machines and spy on businesses in the west. Back then, the group was observed installing two malicious programs on baremetal hypervisors, using vSphere Installation Bundles the same ones as in this attack. Furthermore, they discovered a unique malware/dropper dubbed VirtualGate.