The private encryption key used by Chinese hackers to break into the email accounts of high-level U.S. government officials disclosed last week also gave them access to a vast array of other Microsoft products, according to new research from cloud security firm Wiz.

On July 11, the Redmond-based tech giant disclosed that a threat actor linked to the Chinese government had — through an acquired Microsoft private encryption key — forged authentication tokens that gave them access to Exchange Online Outlook email accounts for more than 25 organizations, including government agencies.

In a blog post published Friday, Shir Tamari, head of research at Wiz, said further investigation has revealed the compromised key would have given the hacking group, which Microsoft calls Storm-0558, access to far more than Outlook, spanning many other Microsoft services that uses the same authentication process.

“Our researchers concluded that the compromised MSA key could have allowed the threat actor to forge access tokens for multiple types of Azure Active Directory applications, including every application that supports personal account authentication, such as SharePoint, Teams, OneDrive, customers’ applications that support the ‘login with Microsoft’ functionality, and multi-tenant applications in certain conditions,” Tamari wrote.

Wiz said they worked closely with Microsoft in advance to ensure the technical accuracy of their findings.

A Chinese cyberespionage group tracked as UNC3886 has been observed exploiting a VMware ESXi zero-day vulnerability to escalate privileges on guest virtual machines, Mandiant warns.

Initially detailed in September 2022, UNC3886 has been using malicious vSphere Installation Bundles (VIBs) – packages that are typically used to maintain systems and deploy updates – to install backdoors on ESXi hypervisors and gain command execution, file manipulation, and reverse shell capabilities.

The group’s malicious actions would impact VMware ESXi hosts, vCenter servers, and Windows virtual machines (VM).

In recent attacks, the cyberspies were seen harvesting credentials from vCenter Server for all connected ESXi hosts, deploying backdoors using VMCI sockets for lateral movement and persistence, and modifying and disabling logging services on compromised systems.

Additionally, the group has been exploiting a zero-day vulnerability in VMware Tools to bypass authentication and execute privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.

Tracked as CVE-2023-20867, the vulnerability has a ‘low severity’ rating, because its exploitation requires that the attacker has root access to the ESXi server.

“A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine,” VMware explains in an advisory. VMware Tools version 12.2.5 resolves the flaw.

According to Mandiant, UNC3886 was seen using scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database, enumerating all ESXi hosts and their guest VMs, and modifying lists of allowed IPs across all connected ESXi hosts.

The cyberspies also used installation scripts to deploy malicious VIBs to hosts, and exploited CVE-2023-20867 to execute commands and transfer files from the compromised ESXi host to and from guest VMs, without authentication and without a trace.

“Additionally, the use of CVE-2023-20867 does not generate an authentication log event on the guest VM when commands are executed from the ESXi host,” Mandiant explains.

The cybersecurity firm also observed the group deploying two backdoors (VirtualPita and VirtualGate) using VMCI sockets for lateral movement and continued persistence.

The malware provides the attackers with a new level of persistence (access to the infected ESXi host is regained by accessing a VM) that also allows for network segmentation bypass and evasion of security reviews for open listening ports.

In conjunction with CVE-2023-20867, the regained access to the ESXi host allows the attackers to perform “unauthenticated actions with the highest privileged accounts across any virtual machine running underneath that ESXi host,” Mandiant notes.

“If a vCenter exists as a virtual machine underneath the ESXi host, the attacker can proceed to harvest all connected vpxuser credentials for all ESXi hosts connected to the vCenter and continue to laterally pivot across the environment,” Mandiant adds.

UNC3886 is known for exploiting zero-day bugs in firewall and virtualization solutions in attacks targeting defense, technology, and telecommunication organizations in the US and in the Asia-Pacific region.