Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023

UNC3886 has established remote SSH access to targeted ESXi hosts.

UNC3886 has replaced atomic indicators mentioned in threat intelligence publications, sometimes as quickly as under a week after release.

UNC3886 has run scripts to list all running processes on a guest VM from an ESXi host.

UNC3886 has used Python scripts to enumerate ESXi hosts and guest VMs.

UNC3886 has used the esxcli command line utility to modify firewall rules, install malware, and for artifact removal.

UNC3886 has exploited zero-day vulnerability CVE-2023-20867 to enable execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.

UNC3886 has used scripts to timestomp ESXi hosts prior to installing malicious vSphere Installation Bundles (VIBs).

UNC3886 has harvested and used vCenter Server service accounts.

UNC3886 has used `vmtoolsd.exe` to enumerate files on guest machines.

UNC3886 has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.

UNC3886 has used installation scripts to collect the system time on targeted ESXi hosts.

UNC3886 has used vSphere Installation Bundles (VIBs) to install malware and establish persistence across ESXi hypervisors.

UNC3886 has utilzed Python scripts to transfer files between ESXi hosts and guest VMs.

UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.

UNC3886 has used scripts to enumerate ESXi hypervisors and their guest VMs.

UNC3886 used `vmtoolsd.exe` to run commands on guest virtual machines from a compromised ESXi host.

UNC3886 has replaced indicators mentioned in open-source threat intelligence publications at times under a week after their release.

UNC3886 has used the TABLEFLIP traffic redirection utility and the esxcli command line to modify firewall rules.

UNC3886 has tampered with and disabled logging services on targeted systems.