Chinese hackers compromise servers using chained exploits and VMware zero day

A suspected Chinese hacking campaign compromised 25 servers and breached a network affiliated with the United States government, InfoSecurity Magazine and The Hacker News reported. InfoSecurity Magazine stated that an investigation by cyber defense platform provider Dream discovered attackers targeting Palo Alto Network servers across the United States, Japan, Taiwan, and South Korea. The Hacker News and InfoSecurity Magazine both confirmed that 25 servers were rooted during the operation. [1][8]

The campaign chained PHP2Shell vulnerabilities with a Linux kernel privilege escalation bug to gain root access to Palo Alto Network firewall and management servers, InfoSecurity Magazine and Help Net Security reported. Help Net Security identified the Linux kernel vulnerability as the Fragnesia bug and noted that the China nexus group involved is known as Warp Panda. InfoSecurity Magazine added that attackers focused on three specific servers in a US government affiliated environment, allowing them persistent access to an internal Active Directory domain. [1][4]

The hackers also exploited a VMware ESXi zero day vulnerability to conceal malicious activity on compromised servers, Help Net Security, CyberSecurityNews, and GBHackers News reported. Help Net Security noted that attackers used the zero day to hide their tracks while running exploits. GBHackers News reported that the VMware zero day was also used to target law firms in cyber espionage operations. [4][6][7]

Relations between the United States and China have involved persistent disputes over economic policies, the political status of Taiwan, and strategic competition, creating ongoing geopolitical tensions. [9]