UNC3886: vCenter RCE to ESXi Persistence (CVE-2023-34048)

VMware vCenter logs an unexpected crash of its DCERPC service at 06:39, minutes after a burst of malformed payloads from a single external address. By morning, unsigned VMware Installation Bundles have been deployed on every ESXi hypervisor, a VMCI reverse-tunnel daemon is routing covert traffic from the kernel layer, and guest VM credentials have been extracted without a single packet crossing the guest network stack. Piece together the chain from the management-plane exploit through the hypervisor implant to the below-the-guest credential theft.