UNC3886 Exploits Fortinet, VMware, and Use Covert Measures for Prolonged Surveillance
The cyber espionage group associated with the exploitation of vulnerabilities in Fortinet, Ivanti, and VMware products is utilizing various tactics to maintain access to compromised systems.
“The methods used by this group include targeting network hardware, virtualization platforms, and virtual machines, ensuring multiple entry points are available even if one is discovered and neutralized,” detailed a new report by experts at Mandiant.
The specific threat actor in focus is UNC3886, characterized by the threat intelligence team at Google as “sophisticated, careful, and difficult to trace.”
The malicious activities conducted by this group employ undisclosed vulnerabilities like CVE-2022-41328 (Fortinet FortiOS), CVE-2022-22948 (VMware vCenter), and CVE-2023-20867 (VMware Tools) to execute various malicious operations, including deploying unauthorized access points and harvesting authentication information for deeper intrusion.
The group was also observed taking advantage of a vulnerability indexed as CVE-2022-42475, another security lapse impacting Fortinet FortiGate, soon after its public acknowledgment by the security provider.
The infiltration campaigns mainly targeted organizations in North America, Southeast Asia, and Oceania, with additional victims located in Europe, Africa, and various other parts of Asia. The victims belonged to sectors such as government, telecommunications, technology, aerospace, defense, and energy.
A standout strategy employed by UNC3886 involves the development of avoidance techniques to bypass security solutions, allowing prolonged undetected surveillance on government and corporate networks.
This involves the utilization of open-source rootkits like Reptile and Medusa on guest virtual machines (VMs), the latter being propagated using an installation mechanism labeled SEAELF.
“Unlike the REPTILE rootkit, which offers interactive access with rootkit functionalities, MEDUSA has the capabilities to log user credentials from successful authentications, local or remote, as well as executing commands,” Mandiant highlighted. “These functionalities aid UNC3886 in moving laterally using valid credentials.”
Additionally, the attackers planted two covert paths identified as MOPSLED and RIFLESPINE that exploit reputable services like GitHub and Google Drive as conduits for command-and-control (C2) operations.
MOPSLED, an advanced form of the Crosswalk malware, is a modular implant operated via shellcode and communicates over HTTP to download plugins from a GitHub C2 server, whereas RIFLESPINE is a versatile tool that uses Google Drive for file transfers and command executions.
Mandiant also identified UNC3886 using compromised SSH clients to steal credentials following the exploitation of CVE-2023-20867 and employing Medusa to create custom SSH servers for the same purpose.
“The initial attempt by the threat actor to expand their control over network assets by targeting the TACACS server involved the use of LOOKOVER,” highlighted the report. “LOOKOVER is a C-written sniffer that decodes TACACS+ authentication packets, decrypting them and saving the content to a specified file path.”
Some of the malware families observed during assaults on VMware environments include –
- A malicious version of a legitimate TACACS daemon featuring credential interception capabilities
- VIRTUALSHINE, a backdoor based on VMware VMCI sockets enabling shell access
- VIRTUALPIE, a Python-infused backdoor supporting file exchange, customized command execution, and reverse shell functions
- VIRTUALSPHERE, a control module tied to a VMCI-based backdoor
Virtual machines have increasingly attracted threat actors over the years due to their widespread use in cloud platforms.
“A compromised VM not only reveals the data within the instance but also the permissions allocated to it,” explained experts at Palo Alto Networks Unit 42 stated. “Given that compute workloads like VMs are typically transient and unchangeable, the risk presented by a compromised identity arguably outweighs that of compromised data within a VM.”
It is recommended for organizations to abide by the security directives outlined in the Fortinet and VMware advisories to fortify defenses against potential threats.
About Author
