Chinese hackers exploit VMware bug as zero-day for two years

Mandiant attributes a long-running Chinese APT (UNC3886) campaign to exploitation of a VMware vCenter zero-day (CVE-2023-34048) since at least late 2021 to breach vCenter servers, deploy VirtualPita/VirtualPie backdoors on ESXi via malicious VIBs, and leverage a VMware Tools authentication bypass (CVE-2023-20867) to escalate privileges and exfiltrate data; the actor also exploited a Fortinet zero-day (CVE-2022-41328) to install Castletap and Thincrust implants, demonstrating sophisticated, targeted espionage against high-value sectors.