Prolonged Chinese Cyber Espionage Campaign Targets VMware Appliances
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-1388 | Unauthenticated RCE in F5 BIG-IP via Missing Authentication F5 BIG-IP contains a critical missing-authentication flaw (CWE-306) in its iControl REST control plane: an unauthenticated attacker with network reachability to the management interface, or to self IPs exposing the REST service on TCP 443, can bypass authentication completely. By sending specially crafted HTTP requests, the attacker gains the ability to execute arbitrary code, create or delete files, and disable services, effectively achieving full takeover of the load balancer or security appliance and the traffic it handles. All F5 BIG-IP deployments running unpatched software are affected; the provided data does not enumerate exact version ranges, which are listed in F5's May 2022 security advisory. The flaw was added to CISA's KEV catalog on 2022-05-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), indicating active in-the-wild exploitation. No public proof-of-concept is catalogued in the provided data, but the KEV listing and known ransomware use confirm real-world attacks. Do: Upgrade affected F5 BIG-IP systems to the fixed releases listed in F5's May 2022 security advisory (K23605340) immediately, prioritizing appliances whose management interface or self IPs on TCP 443 are reachable from untrusted networks; as an interim mitigation, block untrusted access to the management interface and the iControl REST service. Because this flaw is in CISA's KEV catalog with known ransomware use, also hunt for signs of compromise (unexpected files, disabled services, unknown persistence) on any system that was exposed before patching. | 9.8 | 100% | KEV ransomware PoC ×4 |
| large~10,000 internet-exposed BIG-IP systems (public scans at disclosure counted 8k-10k+), with a far larger installed base behind firewalls | |
| CVE-2023-34048 | Unauthenticated Out-of-Bounds Write RCE in VMware vCenter Server VMware vCenter Server contains an out-of-bounds write vulnerability (CWE-787) in its implementation of the DCERPC protocol. A remote, unauthenticated attacker with network access to vCenter Server can send crafted DCERPC traffic that corrupts memory, potentially leading to remote code execution on the vCenter appliance. Because vCenter is the central management plane for VMware vSphere environments, full compromise of it hands attackers a high-value foothold for lateral movement, consistent with the critical 9.8 CVSS score. Any organization running an affected VMware vCenter Server release is exposed (exact version ranges per VMware's advisory, including VMware Cloud Foundation deployments that bundle vCenter). Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-01-22, a public PoC is available, news reports describe China-linked APT UNC3886 exploiting it as a zero-day, and EPSS estimates a 99.4% probability of exploitation within 30 days. Do: Immediately upgrade vCenter Server — and VMware Cloud Foundation deployments that bundle it — to the patched builds identified in VMware's advisory, prioritizing internet-facing instances; if patching must wait, restrict network access to the vCenter management interface as the CISA KEV required action permits. Because exploitation is confirmed in the wild including by an APT, also hunt for signs of compromise such as unexpected processes or authentication activity on vCenter hosts and managed ESXi estate. | 9.8 | 99% | KEV PoC |
| mass≈100,000+ vCenter Server deployments globally (tens of thousands directly internet-exposed per public scans, far more reachable on internal networks) |
Full article536 words · extracted from infosecurity-magazine.com · click to collapse
A prolonged Chinese cyber espionage campaign is targeting VMware appliances to gain access to target networks, according to Sygnia researchers.
The campaign has been tracked since early 2025. The attackers, dubbed Fire Ant, have been observed using combinations of sophisticated and stealthy techniques to create multilayered attack kill chains, which facilitate access to restricted and segmented network assets.
The threat actor has demonstrated consistent targeting of virtualization and network infrastructure, particularly VMware infrastructure.
These systems are used as footholds for initial access, lateral movement and long-term persistence in victim networks.
“Fire Ant’s operations are characterized by infrastructure-centric TTPs, enabling activity beneath the detection threshold of traditional endpoint controls, highlighting critical blind spots of conventional security stacks,” the Sygnia researchers wrote in a blog dated July 24.
Multiple aspects of the Fire Ant campaign, including its unique tool set and targeting VMware virtualization infrastructure, strongly align with techniques used by a Chinese nation-state espionage group tracked by Mandiant as UNC3886.
“The active working hours of the threat group throughout the incidents and minor input errors observed during command execution aligned with Chinese-language keyboard layouts, consistent with prior regional activity indicators,” Sygnia added.
Read now: SharePoint 'ToolShell' Vulnerabilities Exploited by Chinese Nation-State Hackers
Gaining Access to Virtualization Infrastructure
As part of the campaign, Fire Ant exploited an out-of-bounds write vulnerability CVE-2023-34048 to achieve unauthenticated remote code execution on VMware’s vCenter, gaining control over the virtualization layer.
From this base, the attackers conducted a range of techniques to achieve persistence and lateral movement across target environments.
The actor deployed multiple backdoors on VMware ESXi hosts and the vCenter to maintain access across reboots.
With control over the hypervisor, the attacker interacted directly with guest virtual machines. This included executing commands via PowerCLI without in-guest credentials, tampering with security tools and extracting credentials from memory snapshots.
“This approach enabled full-stack compromise, providing persistent, covert access from the hypervisor to guest operating systems,” the researchers said.
Compromising Network Infrastructure
The attackers then set about discovering internal, isolated assets in target networks. This involved the use of sophisticated techniques to bypass segmentation boundaries and establish cross-segments persistence.
This including compromising F5 load balancers by exploiting CVE-2022-1388, a critical vulnerability in the iControlREST API that allows unauthenticated command execution.
This allowed the attackers to deploy webshells, including a tunneling webshell that enabled bridging between networks connected to the load balancer.
They also used commands to route traffic through trusted endpoints, enabling them to reach network-restricted assets without triggering firewall rules or segmentation controls.
Another approach observed by Fire Ant was to maneuver through eradication efforts by network defenders.
“As defenders cleaned systems and removed tools and persistence, the threat actor re-compromised assets. After re-compromising assets, the threat actor rotated the deployed toolsets, altered execution methods, and renamed binaries to avoid detection,” the researchers noted.
Indicators of Fire Ant Activity
The Sygnia report set out key indicators of Fire Ant activity that network defenders should monitor for. These include:
- Unexpected termination of ‘vmsyslogd’ process within ESXi
- Unauthorized execution of ‘vim-cmd’ or ‘esxcli’ commands
- Unique process execution on ESXi hosts
- Rogue virtual machine execution via the ‘vmx -x’ binary
- Guest command execution with ‘vmtoolsd.exe‘ as parent process
- Stale EDR agents on active virtual machines
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/chinese-espionage-targets-vmware/