Rising Sophistication of Chinese Hackers in Cyber Espionage Attacks.

Chinese hackers, identified as UNC3886, have exploited a zero-day vulnerability in the Fortinet FortiOS operating system to deploy backdoors onto Fortinet and VMware solutions and maintain persistent access to victim environments. The vulnerability, tracked as CVE-2022-41328, was patched by Fortinet on March 7, 2023. The attacks mounted by UNC3886 targeted Fortinet's FortiGate, FortiManager, and FortiAnalyzer appliances to deploy two different implants such as THINCRUST and CASTLETAP. The group was previously tied to another intrusion set targeting VMware ESXi and Linux vCenter servers as part of a hyperjacking campaign designed to drop backdoors such as VIRTUALPITA and VIRTUALPIE.