UNC3886 Uses Fortinet, VMware 0-Days and Stealth Tactics in Long
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-22948 | Information Disclosure via Incorrect File Permissions in VMware vCenter Server VMware vCenter Server ships certain files with incorrectly permissive default file permissions, creating an information disclosure vulnerability (CWE-276). A malicious actor with non-administrative (low-privileged) network access to the vCenter Server can exploit the misconfigured permissions to read sensitive information; per the CVSS vector there is confidentiality impact only, with no integrity or availability effect. Any organization running VMware vCenter Server, or VMware Cloud Foundation whose vCenter Server component is affected, is exposed to the flaw. CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-07-17, indicating exploitation in the wild, and EPSS currently assigns a 13.3% probability of exploitation within 30 days (96th percentile); no public proof-of-concept is known. Do: Upgrade vCenter Server and the vCenter Server component of Cloud Foundation to the fixed releases cited in VMware's advisory for CVE-2022-22948, per the CISA KEV required action (or discontinue use if patching is unavailable). Given the KEV listing and headlines describing stealthy VMware-focused activity by UNC3886, prioritize internet-exposed and high-value vCenter deployments, review which non-administrative accounts can reach the vCenter appliance, and monitor those accounts and vCenter logs for signs of unauthorized file access. | 6.5 | 13% | KEV |
| masshundreds of thousands of vCenter Server instances worldwide, with tens of thousands exposed directly to the internet per public scans | |
| CVE-2022-41328 | Path Traversal in Fortinet FortiOS Exploited in Targeted Attacks CVE-2022-41328 is a path traversal flaw (CWE-22) in Fortinet FortiOS in which the system fails to properly limit file paths, allowing crafted CLI commands to escape the restricted directory. A privileged attacker — one who already has CLI access to the device — can issue these crafted commands to read and write arbitrary files on the underlying Linux system, effectively breaking out of the FortiOS CLI sandbox. That post-compromise capability is valuable for stealth and persistence, since changes to system files on the underlying OS may not be visible through normal FortiOS administration. Organizations running FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, or any release before 6.4.11 are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-14, carries a high EPSS score (10.7% probability of exploitation within 30 days, 96th percentile), and public reporting describes its use in targeted cyberattacks on government entities attributed to the espionage group tracked as UNC3886, though no public proof-of-concept code is known. Do: Upgrade all affected FortiGate/FortiOS devices to a fixed release beyond the affected ranges — 7.2.4 or later, 7.0.10 or later, or 6.4.11 or later — per Fortinet's advisory, as required by the CISA KEV entry. Restrict privileged CLI access (admin accounts, trusted-host/local-in policies) and review CLI logs plus the underlying Linux filesystem for unexpected file changes as signs of compromise, particularly on government or otherwise high-value networks given UNC3886 targeting. | 7.1 | 11% | KEV |
| masshundreds of thousands of FortiGate deployments (well over 100,000 internet-facing FortiGates appear in public scans) | |
| CVE-2022-42475 | Unauthenticated Heap Overflow in Fortinet FortiOS/FortiProxy SSL-VPN (Critical RCE) CVE-2022-42475 is a critical (CVSS 9.8) heap-based buffer overflow in the SSL-VPN service of Fortinet FortiOS and FortiProxy. A remote, unauthenticated attacker can trigger it by sending specifically crafted requests to an exposed SSL-VPN interface, with no user interaction or credentials required. Successful exploitation yields arbitrary code or command execution on the appliance, giving attackers a foothold on the perimeter device from which they can pivot into internal networks. Any organization running the listed FortiOS (6.0 through 7.2) or FortiProxy (7.0/7.2) versions with SSL-VPN enabled is affected. Exploitation is confirmed in the wild: the flaw is in CISA KEV with known ransomware use, has near-certain exploitation probability (EPSS 99.5%), and has been used in targeted government attacks and a Chinese-nexus espionage campaign that compromised over 20,000 systems, with attackers also noted to retain access even after patching. Do: Upgrade FortiOS and FortiProxy to fixed releases per Fortinet advisory FG-IR-22-398 (any version beyond the listed affected ranges), and reboot the appliance after patching to clear lingering SSL-VPN sessions since attackers have been observed retaining access post-patch. Check for indicators of compromise such as unknown local accounts, unexpected processes, and anomalous historical logins, and rotate SSL-VPN credentials if compromise is suspected. If SSL-VPN is not required, disable it or restrict exposure to trusted sources until patched. | 9.8 | 99% | KEV ransomware PoC |
| masshundreds of thousands of internet-exposed FortiGate/FortiProxy SSL-VPN endpoints (well over 100,000; 20,000+ confirmed victims in a single campaign) | |
| CVE-2023-20867 | Authentication Bypass in VMware Tools Lets Compromised ESXi Hosts Run Guest Operations VMware Tools, the agent installed inside guest virtual machines, fails to properly authenticate host-to-guest operations when they are issued from an ESXi host (CVE-2023-20867, CWE-287 improper authentication). An attacker who has already gained full (root) control of an ESXi host can invoke these operations, such as running commands or moving files inside guest VMs, and the guests' VMware Tools will accept them without valid authentication. This gives an attacker a foothold in guest VMs without guest credentials, affecting guest confidentiality and integrity. Any organization running VMware ESXi/vSphere with VMware Tools in its guests is affected, and the component is also shipped as open-vm-tools in Debian and Fedora. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-06-23 (EPSS 13.5%, 96th percentile), and China-linked APT UNC3886, whose 'Fire Ant' tooling targets ESXi and vCenter, has been reported using it alongside other VMware flaws. Do: Upgrade VMware Tools / open-vm-tools to the latest fixed release distributed by VMware, Debian, or Fedora per the vendor advisory, and inventory guests running outdated Tools. Because exploitation requires a fully compromised ESXi host, hunt for signs of host compromise (unexpected processes, modified VIBs, suspicious vCenter activity) and review guest VMs for unexplained command execution or persistence. Consistent with the KEV required action, prioritize patching, starting with internet-facing ESXi hosts and virtualization management infrastructure. | 3.9 | 14% | KEV |
| mass≈millions of guest VMs (VMware Tools is installed by default on nearly all VMware guests), though actual exploitability requires an already fully compromised… |
Full article646 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 19, 2024Zero-Day Exploits / Cyber Espionage
The China-nexus cyber espionage actor linked to the zero-day exploitation of security flaws in Fortinet, Ivanti, and VMware devices has been observed utilizing multiple persistence mechanisms in order to maintain unfettered access to compromised environments.
"Persistence mechanisms encompassed network devices, hypervisors, and virtual machines, ensuring alternative channels remain available even if the primary layer is detected and eliminated," Mandiant researchers said in a new report.
The threat actor in question is UNC3886, which the Google-owned threat intelligence company branded as "sophisticated, cautious, and evasive."
Attacks orchestrated by the adversary have leveraged zero-day flaws such as CVE-2022-41328 (Fortinet FortiOS), CVE-2022-22948 (VMware vCenter), and CVE-2023-20867 (VMware Tools) to perform various malicious actions, ranging from deploying backdoors to obtaining credentials for deeper access.
It has also been observed exploiting CVE-2022-42475, another shortcoming impacting Fortinet FortiGate, shortly after its public disclosure by the network security company.
These intrusions have primarily singled out entities in North America, Southeast Asia, and Oceania, with additional victims identified in Europe, Africa, and other parts of Asia. Targeted industries span governments, telecommunications, technology, aerospace and defense, and energy and utility sectors.
A notable tactic in UNC3886's arsenal is that it developed techniques that evade security software and enable it to burrow into government and business networks and spy on victims for extended periods of time without detection.
This entails the use of publicly available rootkits like Reptile and Medusa on guest virtual machines (VMs), the latter of which is deployed using an installer component dubbed SEAELF.
"Unlike Reptile, which only provides an interactive access with rootkit functionalities, Medusa exhibits capabilities of logging user credentials from the successful authentications, either locally or remotely, and command executions," Mandiant noted. "These capabilities are advantageous to UNC3886 as their modus operandi to move laterally using valid credentials."
Also delivered on the systems are two backdoors named MOPSLED and RIFLESPINE that take advantage of trusted services like GitHub and Google Drive as command-and-control (C2) channels.
MOPSLED, a likely evolution of the Crosswalk malware, is a shellcode-based modular implant that communicates over HTTP to retrieve plugins from a GitHub C2 server, while RIFLESPINE is a cross-platform tool that makes use of Google Drive to transfer files and execute commands.
Mandiant said it also spotted UNC3886 deploying backdoored SSH clients to harvest credentials post the exploitation of CVE-2023-20867 as well as leveraging Medusa to set up custom SSH servers for the same purpose.
"The threat actor's first attempt to extend their access to the network appliances by targeting the TACACS server was the use of LOOKOVER," it noted. "LOOKOVER is a sniffer written in C that processes TACACS+ authentication packets, performs decryption, and writes its contents to a specified file path."
Some of the other malware families delivered during the course of attacks aimed at VMware instances are below -
- A trojanized version of a legitimate TACACS daemon with credential-logging functionality
- VIRTUALSHINE, a VMware VMCI sockets-based backdoor that provides access to a bash shell
- VIRTUALPIE, a Python backdoor that supports file transfer, arbitrary command execution, and reverse shell capabilities
- VIRTUALSPHERE, a controller module associated with a VMCI-based backdoor
Over the years, virtual machines have become lucrative targets for threat actors owing to their widespread use in cloud environments.
"A compromised VM can provide attackers with access to not only the data within the VM instance but also the permissions assigned to it," Palo Alto Networks Unit 42 said. "As compute workloads like VMs are generally ephemeral and immutable, the risk posed by a compromised identity is arguably greater than that of compromised data within a VM."
Organizations are advised to follow the security recommendations within the Fortinet and VMware advisories to secure against potential threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/06/chinese-cyber-espionage-group-exploits.html