Chinese Hackers Silently Weaponized VMware Zero-Day Flaw for 2 Years

Omega Balla
An advanced China-nexus cyber espionage group previously linked to the exploitation of security flaws in VMware and Fortinet appliances has been linked to the abuse of a critical vulnerability in VMware vCenter Server as a zero-day since late 2021.

An advanced China-nexus cyber espionage group previously linked to the exploitation of security flaws in VMware and Fortinet appliances has been linked to the abuse of a critical vulnerability in VMware vCenter Server as a zero-day since late 2021.

“UNC3886 has a track record of utilizing zero-day vulnerabilities to complete their mission without being detected, and this latest example further demonstrates their capabilities,” Google-owned Mandiant said in a Friday report.

The vulnerability in question is CVE-2023-34048 (CVSS score: 9.8), an out-of-bounds write that could be put to use by a malicious actor with network access to vCenter Server. It was fixed by the Broadcom-owned company on October 24, 2023.

The virtualization services provider, earlier this week, updated its advisory to acknowledge that “exploitation of CVE-2023-34048 has occurred in the wild.”

UNC3886 first came to light in September 2022 when it was found to leverage previously unknown security flaws in VMware to backdoor Windows and Linux systems, deploying malware families like VIRTUALPITA and VIRTUALPIE.

The latest findings from Mandiant show that the zero-day weaponized by the nation-state actor targeting VMware was none other than CVE-2023-34048, allowing it to gain privileged access to the vCenter system, and enumerate all ESXi hosts and their respective guest virtual machines attached to the system.

The next phase of the attack involves retrieving cleartext “vpxuser” credentials for the hosts and connecting to them in order to install the VIRTUALPITA and VIRTUALPIE malware, thereby enabling the adversary to directly connect to the hosts.

This ultimately paves for the exploitation of another VMware flaw, (CVE-2023-20867, CVSS score: 3.9), to execute arbitrary commands and transfer files to and from guest VMs from a compromised ESXi host, as revealed by Mandiant in June 2023.

VMware vCenter Server users are recommended to update to the latest version to mitigate any potential threats.

In recent years, UNC3886 has also taken advantage of CVE-2022-41328 (CVSS score: 6.5), a path traversal flaw in Fortinet FortiOS software, to deploy THINCRUST and CASTLETAP implants for executing arbitrary commands received from a remote server and exfiltrating sensitive data.

These attacks specifically single out firewall and virtualization technologies owing to the fact that they lack support for endpoint detection and response (EDR) solutions in order to persist within target environments for extended periods of time.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

 The Hacker News 

Total
0
Shares
Leave a Reply

Your email address will not be published. Required fields are marked *

Previous Post

Apache ActiveMQ Flaw Exploited in New Godzilla Web Shell Attacks

Next Post

MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries

Related Posts

Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws

Juniper Networks has released out-of-band updates to address high-severity flaws in SRX Series and EX Series that could be exploited by a threat actor to take control of susceptible systems. The vulnerabilities, tracked as CVE-2024-21619 and CVE-2024-21620, are rooted in the J-Web component and impact all versions of Junos OS. Two other shortcomings, CVE-2023-36846 and
Avatar
Read More

New Banking Trojan CHAVECLOAK Targets Brazilian Users via Phishing Tactics

Users in Brazil are the target of a new banking trojan known as CHAVECLOAK that's propagated via phishing emails bearing PDF attachments. "This intricate attack involves the PDF downloading a ZIP file and subsequently utilizing DLL side-loading techniques to execute the final malware," Fortinet FortiGuard Labs researcher Cara Lin said. The attack chain involves the use of
Siva Ramakrishnan
Read More