UPDATE to 4/15/22 FLASH UPDATE: The Cybersecurity and Infrastructure Security Agency (CISA), has published an emergency directive (22-03) titled “Mitigate VMware Vulnerabilities,” alongside an alert titled “Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control.” The directive warns Federal Civilian Executive Branch (FCEB) agencies that they are at great risk for compromise and must comply with the order immediately. The directive follows the active exploitation of two (2) VMware vulnerabilities that the company successfully patched on April 6, 2022. The flaws, tracked as CVE-2022-22954 and CVE-2022-22960, are a server-side template injection remote code execution (RCE) vulnerability, and a local privilege escalation vulnerability, respectively. If exploited, unauthorized threat actors are able to escalate their privileges to root, giving them the access they need to perform the RCE of malicious payloads. At the time the flaws were patched, threat actors had been exclusively exploiting them to execute coinminer payloads in VMware infrastructure that hijack server resources to maintain a blockchain ledger to generate cryptocurrency. However, the exploit also offers threat actors the ability to move laterally across the network, which opens up the opportunities to conduct devastating malicious activity. Depending on the enterprise deployment of VMware instances, shutting down systems to install the new patches may induce a substantial negative impact to business processes. Due to this procrastination, there are still many instances of VMware distributions vulnerable to these flaws, and agencies and companies are beginning to suffer attacks from both state-sponsored and financially motivated threat actors. The issue with vulnerabilities like these, which support massive technical business processes, is that when researchers eventually publish the exploit, bad actors reverse engineer the exploits and patches to find new attack vectors and methods. On May 18, 2022, VMware patched two (2) new vulnerabilities tracked as CVE-2022-22972 and CVE-2022-22973, described as an authentication bypass, and another local privilege escalation vulnerability, respectively. They pose very similar threats to the same VMware products, and now that the exploits are public, threat actors will again, work tirelessly to reverse-engineer them, knowing that many organizations will hesitate to patch. This is why CISA has published the directive, to ensure that this does not happen again, and to hold the FCEB agencies who don’t comply accountable. Leaving these types of vulnerabilities unpatched poses a great risk not only to the agencies themselves, but to the third parties they work with. In the alert CISA confirms they have “received information—including indicators of compromise (IOCs)—about observed exploitation at multiple other large organizations from trusted third parties,” however the names of the organizations and threat actors have not been made public. CTIX analysts will continue to monitor this chain of vulnerabilities, and publish updates as needed. We recommend that all administrators leveraging the VMware products listed in the below advisories update to the latest patch immediately.