China-linked group Fire Ant exploits VMware and F5 flaws since early 2025
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-1388 | Unauthenticated RCE in F5 BIG-IP via Missing Authentication F5 BIG-IP contains a critical missing-authentication flaw (CWE-306) in its iControl REST control plane: an unauthenticated attacker with network reachability to the management interface, or to self IPs exposing the REST service on TCP 443, can bypass authentication completely. By sending specially crafted HTTP requests, the attacker gains the ability to execute arbitrary code, create or delete files, and disable services, effectively achieving full takeover of the load balancer or security appliance and the traffic it handles. All F5 BIG-IP deployments running unpatched software are affected; the provided data does not enumerate exact version ranges, which are listed in F5's May 2022 security advisory. The flaw was added to CISA's KEV catalog on 2022-05-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), indicating active in-the-wild exploitation. No public proof-of-concept is catalogued in the provided data, but the KEV listing and known ransomware use confirm real-world attacks. Do: Upgrade affected F5 BIG-IP systems to the fixed releases listed in F5's May 2022 security advisory (K23605340) immediately, prioritizing appliances whose management interface or self IPs on TCP 443 are reachable from untrusted networks; as an interim mitigation, block untrusted access to the management interface and the iControl REST service. Because this flaw is in CISA's KEV catalog with known ransomware use, also hunt for signs of compromise (unexpected files, disabled services, unknown persistence) on any system that was exposed before patching. | 9.8 | 100% | KEV ransomware PoC ×4 |
| large~10,000 internet-exposed BIG-IP systems (public scans at disclosure counted 8k-10k+), with a far larger installed base behind firewalls | |
| CVE-2023-20867 | Authentication Bypass in VMware Tools Lets Compromised ESXi Hosts Run Guest Operations VMware Tools, the agent installed inside guest virtual machines, fails to properly authenticate host-to-guest operations when they are issued from an ESXi host (CVE-2023-20867, CWE-287 improper authentication). An attacker who has already gained full (root) control of an ESXi host can invoke these operations, such as running commands or moving files inside guest VMs, and the guests' VMware Tools will accept them without valid authentication. This gives an attacker a foothold in guest VMs without guest credentials, affecting guest confidentiality and integrity. Any organization running VMware ESXi/vSphere with VMware Tools in its guests is affected, and the component is also shipped as open-vm-tools in Debian and Fedora. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-06-23 (EPSS 13.5%, 96th percentile), and China-linked APT UNC3886, whose 'Fire Ant' tooling targets ESXi and vCenter, has been reported using it alongside other VMware flaws. Do: Upgrade VMware Tools / open-vm-tools to the latest fixed release distributed by VMware, Debian, or Fedora per the vendor advisory, and inventory guests running outdated Tools. Because exploitation requires a fully compromised ESXi host, hunt for signs of host compromise (unexpected processes, modified VIBs, suspicious vCenter activity) and review guest VMs for unexplained command execution or persistence. Consistent with the KEV required action, prioritize patching, starting with internet-facing ESXi hosts and virtualization management infrastructure. | 3.9 | 14% | KEV |
| mass≈millions of guest VMs (VMware Tools is installed by default on nearly all VMware guests), though actual exploitability requires an already fully compromised… | |
| CVE-2023-34048 | Unauthenticated Out-of-Bounds Write RCE in VMware vCenter Server VMware vCenter Server contains an out-of-bounds write vulnerability (CWE-787) in its implementation of the DCERPC protocol. A remote, unauthenticated attacker with network access to vCenter Server can send crafted DCERPC traffic that corrupts memory, potentially leading to remote code execution on the vCenter appliance. Because vCenter is the central management plane for VMware vSphere environments, full compromise of it hands attackers a high-value foothold for lateral movement, consistent with the critical 9.8 CVSS score. Any organization running an affected VMware vCenter Server release is exposed (exact version ranges per VMware's advisory, including VMware Cloud Foundation deployments that bundle vCenter). Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-01-22, a public PoC is available, news reports describe China-linked APT UNC3886 exploiting it as a zero-day, and EPSS estimates a 99.4% probability of exploitation within 30 days. Do: Immediately upgrade vCenter Server — and VMware Cloud Foundation deployments that bundle it — to the patched builds identified in VMware's advisory, prioritizing internet-facing instances; if patching must wait, restrict network access to the vCenter management interface as the CISA KEV required action permits. Because exploitation is confirmed in the wild including by an APT, also hunt for signs of compromise such as unexpected processes or authentication activity on vCenter hosts and managed ESXi estate. | 9.8 | 99% | KEV PoC |
| mass≈100,000+ vCenter Server deployments globally (tens of thousands directly internet-exposed per public scans, far more reachable on internal networks) |
Full article746 words · extracted from securityaffairs.com · click to collapse
China-linked group Fire Ant exploits VMware and F5 flaws to stealthily breach secure systems, reports cybersecurity firm Sygnia.
China-linked cyberespionage group Fire Ant is exploiting VMware and F5 vulnerabilities to stealthily access secure, segmented systems, according to Sygnia.
Since early 2025, the group has targeted virtualization and networking infrastructure, primarily VMware ESXi and vCenter environments.
The threat actor used stealthy, layered attack chains to access restricted networks thought to be isolated.
“The attacker demonstrated a high degree of persistence and operational maneuverability, operating through eradication efforts, adapting in real time to eradication and containment actions to maintain access to the compromise infrastructure.” reads the report published by Sygnia. “Sygnia identified tooling and techniques that closely align with prior campaigns attributed to UNC3886. Technical overlap including specific binaries and exploitation of vCenter and ESXi vulnerabilities as well as targeted verticals.”
Fire Ant gained deep control over VMware ESXi and vCenter servers, using unauthenticated host-to-guest commands and credential theft to access guest environments. The group was able to bypass network segmentation by compromising appliances and tunneling through legitimate paths. Fire Ant adapts its strategy to the evolution of containment efforts via toolset changes, persistent backdoors, and network manipulation. The campaign was uncovered through a vmtoolsd.exe anomaly, pointing to host-based injection and leading to the discovery of a broader, stealthy cyberespionage operation.
In some cases, the attack chain started with the exploitation of the critical vCenter Server vulnerability CVE-2023-34048, which allowed the attackers to gain unauthenticated remote code execution and take over the virtualization management layer.
vCenter Server is a critical component in VMware virtualization and cloud computing software suite. It serves as a centralized and comprehensive management platform for VMware’s virtualized data centers.
The vulnerability CVE-2023-34048 (CVSS score 9.8) is an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.
Once compromised the vCenter, Fire Ant moved laterallyto ESXi hosts using stolen vpxuser credentials, deploying persistent backdoors. With hypervisor control, they accessed guest VMs, exploited CVE-2023-20867 to run commands without credentials. The attackers also disabled security tools, and extracted credentials from memory snapshots, including domain controllers.
“As ‘vpxuser’ is used by vCenter for core management tasks, it is exempt from lockdown mode restrictions. This allowed the threat actor to retain host-level access even when direct logins were disabled, gaining control over all connected ESXi hosts.” continues the report. “The threat actor deployed a persistent backdoor binary on vCenter servers across the environment named ‘ksmd‘, located at ‘/usr/libexec/setconf/ksmd’. The binary was configured to listen on TCP port 7475 and enabled remote command execution and file operations.
The backdoor was deployed immediately after a remote login event and remained active across system reboots.”
Fire Ant achieved full-stack compromise, maintaining covert access to guest OSes via the hypervisor and bypassing segmentation through trusted systems.
The cyberespionage group compromised F5 load balancers by exploiting the flaw CVE-2022-1388 in the iControlREST API. An unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses can exploit the CVE-2022-1388 flaw to execute arbitrary system commands, create or delete files, or disable services. Attackers exploited the vulnerability to deploy a staging webshell to ‘usr/local/www/xui/common/css/css.php‘
Then attackers used the deployed webshell to deploy additional webshells in the ‘/xui/common/css/’ directory. One of these webshells, a tunneling webshell, enabled bridging between networks connected to the load balancer.
“To maintain long-term access across the environment, the threat actor established stealthy persistence on key Linux pivot points by deploying a variant of the open-source Medusa rootkit. (https://github.com/ldpreload/Medusa/tree/main)” continues the report. “The Medusa rootkit enables an interactive shell and logs SSH credentials to a file named ‘remote.txt’, supporting both a backdoor to the compromised device and a credential harvesting mechanism.”
Fire Ant showed strong resistance to removal, re-entering systems via backup access paths and adapting tools to evade detection. They studied defenders’ actions, altered tactics, and even disguised malware as forensic tools.
“While Sygnia refrains from conclusive attribution, multiple aspects of Fire Ant’s campaign and most notably its unique tool set and attack vector targeting the VMware virtualization infrastructure strongly align with previous research on the threat group UNC3886.” concludes the report. “The active working hours of the threat group throughout the incidents and minor input errors observed during command execution aligned with Chinese-language keyboard layouts, consistent with prior regional activity indicators.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, VMware)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/180451/hacking/china-linked-group-fire-ant-exploits-vmware-and-f5-flaws-since-early-2025.html