One of the most serious VMware vulnerabilities in recent memory was secretly being exploited by a Chinese advanced persistent threat for years before a patch became available.
In a sign of just how severe this particular issue was, VMware went so far as to extend patches for end-of-life versions of the product, as well.
In at least some cases all that effort might have been too little, too late.
In a Jan. 19 blog post, Mandiant revealed that a Chinese threat actor it tracks as UNC3886 was covertly exploiting CVE-2023-34048 as a zero-day since at least late 2021.
UNC3886's VMWare Exploit UNC3886, which Mandiant describes as a China-nexus espionage group, is exactly the threat actor to pull off this kind of trick.
Though relatively little is known of it, it has been outed for targeting VMware environments before.
Last year for example, Mandiant pieced together that the actor had been exploiting a different VMware zero-day: CVE-2023-20867.
This was a less serious authentication issue in VMware Tools, a set of tools for enhancing performance in guest virtual machines.
A crucial missing piece at the time was how UNC3886 was obtaining full compromise over ESXi hosts - a necessary prerequisite for taking advantage of this flaw.
That answer lay in the VMware service's crash logs.
It appears that this first stage of the exploit chain is what afforded the attackers remote code-execution capabilities in its targets' environments, whereupon they'd steal credentials, and use them to compromise ESXi hosts connected to compromised vCenter server.
Then came the backdoors, then the CVE-2023-20867 exploit.
The canary crashes were observed across multiple UNC3886 attacks between late 2021 and early 2022.
The Bottom Line for VMware Customers Organizations that patched back in October may now need to double check their work to make sure they weren't compromised in the zero-day period.
Those still at risk can find remediation information in VMware's original security advisory from October.
This Cyber News was published on www.darkreading.com. Publication date: Mon, 22 Jan 2024 22:10:19 +0000