An advanced Chinese cyber espionage group has been discovered exploiting a critical vulnerability in VMware vCenter Server (CVE-2023-34048) as a zero-day since late 2021. The Chinese hacking group, tracked as UNC3886, is linked to the exploitation of security flaws in VMware and Fortinet appliances in the past and has a history of utilizing zero-day vulnerabilities to avoid detection. The flaw was patched in October 2023, after it was reported that UNC3886 had used it in a previously reported campaign back in June 2023. The hackers exploited CVE-2023-34048 most recently to breach their targets’ vCenter servers and gain privileged access to enumerate all ESXi hosts and their respective guest virtual machines attached to the system. After retrieving cleartext “vpxuser” credentials for the hosts and connecting to them, the threat actor then installed VIRTUALPITA and VIRTUALPIE malware, enabling a direct connection to the hosts. This paved the way for the next stage of the attack which exploited the VMware Tools authentication bypass flaw (CVE-2023-20867) to escalate privileges, execute arbitrary commands, harvest files, and exfiltrate them from guest VMs on a compromised ESXi host. In the past, UNC3886 took advantage of a path reversal flaw in Fortinet FortiOS software (CVE-2022-41328) that allowed them to deploy THINCRUST and CASTLETAP implants and exfiltrate sensitive data from remote servers. The Chinese attackers have a preference in targeting zero-day security flaws in firewall and virtualization technologies that lack Endpoint Detection and Response (EDR) capabilities to make it easier to persist within a target’s environment. They are also known for their interest in the defense, government, telecom, and technology sectors of the United States and the APJ region. They have been known to conduct highly targeted attacks against government or government-related targets and have showcased a deep understanding of the underlying hardware of their target’s environments, using advanced capabilities such as custom implants and in one case having the ability to reverse-engineer various parts of FortiOS. CTIX analysts recommend that administrators of VMware vCenter Server update to the latest version.