Connect with us

Hi, what are you looking for?



Chinese Cyberspies Caught Exploiting VMware ESXi Zero-Day

Mandiant has observed a Chinese cyberespionage group exploiting a VMware ESXi zero-day vulnerability for privilege escalation.

VMware zero-day CVE-2023-20867 exploited

A Chinese cyberespionage group tracked as UNC3886 has been observed exploiting a VMware ESXi zero-day vulnerability to escalate privileges on guest virtual machines, Mandiant warns.

Initially detailed in September 2022, UNC3886 has been using malicious vSphere Installation Bundles (VIBs) – packages that are typically used to maintain systems and deploy updates – to install backdoors on ESXi hypervisors and gain command execution, file manipulation, and reverse shell capabilities.

The group’s malicious actions would impact VMware ESXi hosts, vCenter servers, and Windows virtual machines (VM).

In recent attacks, the cyberspies were seen harvesting credentials from vCenter Server for all connected ESXi hosts, deploying backdoors using VMCI sockets for lateral movement and persistence, and modifying and disabling logging services on compromised systems.

Additionally, the group has been exploiting a zero-day vulnerability in VMware Tools to bypass authentication and execute privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.

Tracked as CVE-2023-20867, the vulnerability has a ‘low severity’ rating, because its exploitation requires that the attacker has root access to the ESXi server.

“A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine,” VMware explains in an advisory. VMware Tools version 12.2.5 resolves the flaw.

Advertisement. Scroll to continue reading.

According to Mandiant, UNC3886 was seen using scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database, enumerating all ESXi hosts and their guest VMs, and modifying lists of allowed IPs across all connected ESXi hosts.

The cyberspies also used installation scripts to deploy malicious VIBs to hosts, and exploited CVE-2023-20867 to execute commands and transfer files from the compromised ESXi host to and from guest VMs, without authentication and without a trace.

“Additionally, the use of CVE-2023-20867 does not generate an authentication log event on the guest VM when commands are executed from the ESXi host,” Mandiant explains.

The cybersecurity firm also observed the group deploying two backdoors (VirtualPita and VirtualGate) using VMCI sockets for lateral movement and continued persistence.

The malware provides the attackers with a new level of persistence (access to the infected ESXi host is regained by accessing a VM) that also allows for network segmentation bypass and evasion of security reviews for open listening ports.

In conjunction with CVE-2023-20867, the regained access to the ESXi host allows the attackers to perform “unauthenticated actions with the highest privileged accounts across any virtual machine running underneath that ESXi host,” Mandiant notes.

“If a vCenter exists as a virtual machine underneath the ESXi host, the attacker can proceed to harvest all connected vpxuser credentials for all ESXi hosts connected to the vCenter and continue to laterally pivot across the environment,” Mandiant adds.

UNC3886 is known for exploiting zero-day bugs in firewall and virtualization solutions in attacks targeting defense, technology, and telecommunication organizations in the US and in the Asia-Pacific region.

Related: Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies

Related: Fortinet Warns Customers of Possible Zero-Day Exploited in Limited Attacks

Related: New MOVEit Vulnerabilities Found as More Zero-Day Attack Victims Come Forward

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...