Chinese Espionage Campaign Targeting ESXi Hosts

Reesearchers have spotted n espionage campaign by Chinese threat actor UNC3886 targeting VMware ESXi hosts and have quietly been exploiting a zero-day authentication bypass flaw in the virtualization technology to execute privileged commands on guest virtual machines.

The zero-day vulnerability tracked as CVE-2023-208670 is present in VMware Tools, a set of services and modules for enhanced management of guest operating systems.

The bug gives attackers a way to use a compromised ESXi host to transfer files to and from Windows, Linux, and vCenter guest virtual machines without the need for guest credentials — and without any default logging of the activity happening. VMware assessed the flaw as being of medium severity because to exploit it, an attacker already needs to have root access over an ESXi host.

The investigation uncovered new details on the threat actor’s tactics and methods. They found, for instance, the threat actor harvesting credentials for connected ESXi service accounts from vCenter Server appliance and exploiting CVE-2023-20867 to execute privileged commands across guest virtual machines.

Reseaechers found the threat actors deploying backdoors — including VirtualPITA and another called VirtualGATE — using the Virtual Machine Communication Interface (VMCI) socket for lateral movement and additional persistence.

The harvesting of connected ESXi service account credentials on vCenter servers and the capabilities of the VMCI socket backdoor are two new techniques that not seen utilized by other attackers in the past.

The threat actor targeted ESXi hosts belonging to defense, technology, and telecommunications companies.

This research was documented by researchers from Mandiant

Indicators of Compromise

• 2be5f4520846bf493b4694789841907d058fe08d59fff6bad7abe1db8ed96e7d 
• e68872c49aaedeb3bde3ff5fd2ad6f70658687dc02d04f12ebc7cb28e821cc88 
• c2ef08af063f6d416233a4b2b2e991c177fc72d70a76c24bca9080521d41040f 
• 4cf3e0b60e880e6a6ba9f45187ac5454813ae8c2031966d8b264ae0d1e15e70d 
• 23eb8d056f18e7c69ec3568f2833c9d09e91df98d11b11de235331ef42756fe5 
• 4d995eb87b0685124b7f1640d1ab431f5a1ab991ade02750b876ed5c523234bb 
• 505eb3b90cd107cf7e2c20189889afdff813b2fbb98bbdeab65cde520893b168 
• 4a6f559426493abc0d056665f23457e2779abd3482434623e1f61f4cd5b41843 
• 13f11c81331bdce711139f985e6c525915a72dc5443fbbfe99c8ec1dd7ad2209 
• 5731d988781c9a1d2941f7333615f6292fb359f6d48498f32c29878b5bedf00f