UNC3886: vCenter RCE to ESXi Persistence (CVE-2023-34048)
Orbivex Aerospace runs its virtualisation estate on a vCenter Server appliance and three ESXi hypervisors, with the vCenter HTTPS management interface published to the internet. The platform team opened a ticket during the morning shift: the appliance had logged a management daemon terminating on a fatal signal and restarting, and the hypervisor integrity summary listed package and startup-file entries the change record does not account for. Work the vCenter, ESXi and firewall telemetry and establish what reached the estate, how it moved between the management plane and the hypervisors, and how far it got.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Locate the exploit entry point
20The vCenter appliance logged something unusual before anything else happened: a process crash. Determine what service was targeted and what external address drove the crash.
Name the crashed service
15After the exploit landed, a specific VMware appliance process crashed with a segfault. Identify that process by name - it is the first DFIR indicator that exploitation succeeded rather than just failing noisily.
Trace the staging activity
20Immediately after gaining execution on the vCenter appliance, the attacker transferred files onto it. Identify the hidden directory created to hold the staged tooling.
Identify the SSH enablement mechanism
15Before logging into the ESXi hypervisors directly, the attacker had to turn on SSH. Determine the vCenter account used to issue that task.
Name the malicious VIB package
20The backdoor was delivered as a VMware Installation Bundle. Identify the package name that was installed without a valid VMware signature.
Find the persistent backdoor binary
20The VIB dropped a persistent binary that is not part of any standard ESXi installation. Identify its full path on the ESXi filesystem.
Locate the covert C2 channel destination
20The VMCI reverse-tunnel daemon opened a persistent outbound connection from each ESXi host to an external address. Identify that destination.
Trace the guest credential harvest
20The backdoor reached inside running guest VMs to steal credentials without touching the guest network stack. Identify the guest account whose credentials were targeted.
Map the VIB backdoor to its ATT&CK technique
25Unsigned VIBs that persist a backdoor across ESXi reboots represent a documented but underdetected hypervisor technique. Identify the ATT&CK technique that describes modifying the hypervisor's installed package image.
9 tasks · 175 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allDPRK Fake IT Worker: Insider Access and Exfiltration
A fraudulent remote software engineer embedded under a stolen identity gains network access on their first day and immediately begins collecting source code, architecture documentation and cloud secrets. The session originates entirely from a single hosting-range ASN, persists through AnyDesk and ngrok tunnels, and ends with a dual-channel exfiltration via Rclone and AzCopy. Reconstruct the full chain from Azure AD audit events, VPN and endpoint telemetry.
Salt Typhoon: Telecom Carrier Espionage
An Axiom Carrier Services edge router is behaving in ways its change record cannot explain: management sessions from addresses that should never reach it, a configuration change with no ticket behind it, and egress the estate never authorised. Work a full day of router syslog and perimeter firewall traffic and reconstruct what happened to the device, in order.
Cactus Ransomware: Qlik Sense Exploitation
An internet-facing Qlik Sense analytics server is exploited and turned into the launch point for a Cactus ransomware intrusion. Within a day the operator persists with a rogue remote-access agent, dumps domain-admin credentials from memory, pivots by RDP to the domain controller and backup servers, steals engineering data to cloud storage, and deploys ransomware. Work the Qlik web logs, the endpoint process tree and the perimeter traffic to reconstruct the intrusion end to end and tell the abuse apart from a heavy baseline of normal analytics and remote-access activity.