UNC3886

By Ashwin Venugopal -

 






Overview

UNC3886 is a China-linked hacker group, that has been exploiting vCenter server zero-day vulnerability CVE-2023-34048 since at least late 2021. They possess unique capabilities in how they operate on-network as well as tools used in their campaigns. 

They generally targets firewall and virtualization technologies which lack EDR support. This indicates that the group have curated a  deeper-level of understanding of such technologies. They have also modified the publicly available malware. 

How does it works?

According to an investigation, UNC3886 relies on vSphere Installation Bundles (VIBs) to install two backdoors on the ESXi hypervisors, tracked as VIRTUALPITA and VIRTUALPIE. VIBs are collection of files designed to manage virtual systems used to create startup tasks, custom firewall rules, or deploy custom binaries upon the restart of an ESXi machine.

The cyber espionage group harvest credentials for service accounts from a vCenter Server for all the connected ESXi hosts from the embedded vPostgreSQL server built into vCenter Server Appliance. They readily exploit the zero-day vulnerability to execute privileged command across Windows, Linux, and PhotonOS (vCenter) guest VMs without authentication of guest credentials from a compromised ESXi host and no default logging on guest VMs.

After that, backdoors on ESXi hosts are deployed via an alternative socket address family, use VMCl, for lateral movement and maintain persistence. These hackers are also spotted modifying and disabling logging services on compromised systems. 

Prevention

Vigilant awareness about social engineering attacks, that prompts the victim to open files from an untrusted source, is the most effective way to prevent an UNC3886 attack. Organizations engaged with Vietnamese government should be more careful about any document or links posted in public social networking forums. 

Hence, user awareness training to educate internal staff about proper procedures for assessing as well as handling documents, and a full-fledged Defense-in-Depth-based cybersecurity program is the best way to prevent a successful UNC3886 attack.



































Comments

Post a Comment

Popular posts from this blog

Query, Visualize, & Monitor Data in Azure Sentinel

By Ashwin Venugopal -
Image
  Azure Sentinel Workbooks Several ready for use templates are provided by the Azure Sentinel that can be used to create your own workbook and then modify them as needed for Contoso. Most of the data connectors it uses to ingest data come with their own workbooks, but better insight can be obtained by simply looking into the data that is being ingested by using tables and visualizations, including bar and pie charts. You can also make your own workbook easily by using this data from the beginning instead of using the predefined templates. Workbook Page You can easily access the workbook page from the Azure Sentinel from the navigation pane which consists of the: Workbook header- You can add a new workbook and review the saved workbooks as well as templates that are available on the workbook page. Templates section- You can access existing workbook templates on the Templates tab. You can save some of the workbooks for quick access and they will appear on the My Workbooks tab.  From the
Read more

Work with String Data Using KQL Statements

By Ashwin Venugopal -
Image
  Extract Data from Unstructured String Fields Unstructured string fields often contains the Security log data and requires parsing to extract data. There are multiple ways of pulling information from string fields in KQL and the two primary operators used are extract and parse.  Extract It gets a match for a regular expression from a text string. You can convert the extracted substring to the indicated type.  Arguments regex- A regular expression. captureGroup- A positive int constant indicating the capture group to extract. 0 stands for the entire match, 1 for the value matched by the first '('parenthesis')' in the regular expression, 2 or more for subsequent parenthesis.  text- A string to search. typeLiteral- An optional type literal. If provided, the extracted substring is converted to this type.  Returns If regex finds a match in text- the substring matched against the indicated capture group captureGroup, optionally converted to typeLiteral. If there's no mat
Read more

Threat Hunting in Microsoft Sentinel (part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Introducing the Microsoft Sentinel Hunting Page Threat hunting is a series activities performed while investigating and as there are no guidelines to perform it, the available tools on the Microsoft Sentinel can be introduced to perform better in your investigations. Firstly, you have to choose the Hunting link in the Microsoft Sentinel navigation menu to get to the Hunting page which is divided into the following sections: The header bar- It is located at the top of the page as usual and contains Refresh as well as timespan drop down menu. The New Query button can help you with creating a new query and the Run all queries button can run all the hunting queries in the background while also updating the hunting query list section with the number of results found.  The summary bar- Here, you can view the total number of queries available to run, the total number of bookmarks, the number of results from running live
Read more