Chinese Hackers Covertly Armed VMware Bug, Silent for 2 Years

In a recent report, Google-owned Mandiant revealed that a Chinese cyber espionage group, UNC3886, has been exploiting a critical vulnerability in VMware’s vCenter Server as a zero-day since late 2021. The vulnerability, tracked as CVE-2023-34048, allows a malicious actor with network access to vCenter Server to gain privileged access to the system. UNC3886 has a history of utilizing zero-day vulnerabilities to remain undetected while completing their missions. In addition to targeting VMware, the group has also taken advantage of a path traversal flaw in Fortinet FortiOS software. VMware vCenter Server users are advised to update to the latest version to mitigate any potential threats.