Chinese Spies Exploited Critical VMware Bug for Nearly 2 Years

Mandiant revealed that Chinese APT UNC3886 exploited VMware vCenter vulnerability CVE-2023-34048 (CVSS 9.8) as a zero-day since at least late 2021 to gain RCE, trigger VMware Directory Service crashes as a canary, deploy backdoors ('VirtualPita' and 'VirtualPie'), steal credentials, and subsequently compromise ESXi hosts; organizations should confirm patches and investigate possible infections per VMware's advisory.