Initially detailed in September 2022, UNC3886 has been using malicious vSphere Installation Bundles (VIBs) – packages that are typically used to maintain systems and deploy updates – to install backdoors on ESXi hypervisors and gain command execution, file manipulation, and reverse shell capabilities.

The group's malicious actions would impact VMware ESXi hosts, vCenter servers, and Windows virtual machines (VM).

In recent attacks, the cyberspies were seen harvesting credentials from vCenter Server for all connected ESXi hosts, deploying backdoors using VMCI sockets for lateral movement and persistence, and modifying and disabling logging services on compromised systems.

Additionally, the group has been exploiting a zero-day vulnerability in VMware Tools to bypass authentication and execute privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.

Tracked as CVE-2023-20867, the vulnerability has a 'low severity' rating, because its exploitation requires that the attacker has root access to the ESXi server.

"A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine," VMware explains in an advisory. VMware Tools version 12.2.5 resolves the flaw. 

According to Mandiant, UNC3886 was seen using scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database, enumerating all ESXi hosts and their guest VMs, and modifying lists of allowed IPs across all connected ESXi hosts.

The cyberspies also used installation scripts to deploy malicious VIBs to hosts, and exploited CVE-2023-20867 to execute commands and transfer files from the compromised ESXi host to and from guest VMs, without authentication and without a trace.

"Additionally, the use of CVE-2023-20867 does not generate an authentication log event on the guest VM when commands are executed from the ESXi host," Mandiant explains.

The cybersecurity firm also observed the group deploying two backdoors (VirtualPita and VirtualGate) using VMCI sockets for lateral movement and continued persistence.

The malware provides the attackers with a new level of persistence (access to the infected ESXi host is regained by accessing a VM) that also allows for network segmentation bypass and evasion of security reviews for open listening ports.

In conjunction with CVE-2023-20867, the regained access to the ESXi host allows the attackers to perform "unauthenticated actions with the highest privileged accounts across any virtual machine running underneath that ESXi host," Mandiant notes.

"If a vCenter exists as a virtual machine underneath the ESXi host, the attacker can proceed to harvest all connected vpxuser credentials for all ESXi hosts connected to the vCenter and continue to laterally pivot across the environment," Mandiant adds.

UNC3886 is known for exploiting zero-day bugs in firewall and virtualization solutions in attacks targeting defense, technology, and telecommunication organizations in the US and in the Asia-Pacific region.