Threat actorcritical
Prolonged Chinese Cyber Espionage Campaign Targets VMware Appliances
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1388 | Unauthenticated RCE in F5 BIG-IP via Missing Authentication | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2023-34048 | Unauthenticated Out-of-Bounds Write RCE in VMware vCenter Server | 9.8 | 99% | KEVPoC | KEV |
From the original article
2 min read at infosecurity-magazine.com
A prolonged Chinese cyber espionage campaign is targeting VMware appliances to gain access to target networks, according to Sygnia researchers. The campaign has been tracked since early 2025. The attackers, dubbed Fire Ant, have been observed using combinations of sophisticated and stealthy techniques to create multilayered attack kill chains, which facilitate access to restricted and segmented network assets.
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.