UNC3886__2023__Mandiant_Fortinet-Zero-Day-Suspected-Chinese-Operation_03-16-2023.pdf

Executive summary: Mandiant details a suspected China-nexus cyber espionage operation (UNC3886) that exploited the Fortinet FortiOS zero-day CVE-2022-41328 and related VMware ESXi components to deploy multiple custom backdoors across Fortinet appliances (FortiGate, FortiManager, FortiAnalyzer) and ESXi hypervisors, enabling persistent access, credential theft, and lateral movement; the operation employs backdoors such as THINCRUST, CASTLETAP, REPTILE, TABLEFLIP, and VIRTUALPITA, includes anti-forensics, and demonstrates capability to bypass ACLs and stealthily maintain access across environments.