Sygnia uncovers Fire Ant espionage campaign targeting virtualization infrastructure with UNC3886 ties

Cybersecurity firm Sygnia has unveiled details of a sophisticated and persistent espionage campaign, dubbed “Fire Ant,” that has been actively targeting virtualization and networking infrastructure since early 2025. The campaign exhibits strong overlaps with the notorious China-linked cyber espionage group, UNC3886, known for its focus on critical infrastructure and evasive tactics.

Sygnia’s investigation into Fire Ant reveals a concerted effort to compromise VMware ESXi and vCenter environments, as well as various network appliances. The threat actors behind Fire Ant have demonstrated an advanced understanding of these complex systems, leveraging multi-layered attack chains to gain access to highly restricted and segmented networks, even those presumed to be isolated.

A key aspect of the Fire Ant campaign involves the exploitation of known vulnerabilities in VMware products, including CVE-2023-34048 in VMware vCenter Server and CVE-2023-20867 in VMware Tools. By gaining control over the virtualization management layer, the attackers were able to extract sensitive credentials, such as ‘vpxuser’ service account credentials, and deploy persistent backdoors on both ESXi hosts and vCenter servers to maintain access across reboots. This hypervisor-level compromise allowed them to interact directly with guest virtual machines, execute commands without in-guest credentials, and even tamper with security tools and extract credentials from memory snapshots.

What sets Fire Ant apart is its remarkable resilience and adaptability. Sygnia observed the threat actors actively maneuvering through eradication efforts, adjusting their techniques in real-time to maintain a foothold within compromised systems. This included rotating deployed toolsets, altering execution methods, and even renaming binaries to impersonate forensic tools, all to avoid detection and re-establish access after remediation attempts.

The ties to UNC3886 are significant. Sygnia noted close alignments in specific binaries, the exploitation of VMware vulnerabilities, and a similar focus on critical infrastructure sectors. This connection underscores the ongoing threat posed by well-resourced nation-state actors targeting strategic organizations globally. Recent reports from Singapore’s national security minister, Kasiviswanathan Shanmugam, also pointed to UNC3886 as being behind attacks on critical infrastructure in the region, further highlighting the global reach of this threat.

The Fire Ant campaign serves as a critical reminder of the blind spots that often exist within traditional security architectures, particularly at the hypervisor and infrastructure levels where conventional endpoint security tools offer limited protection. Organizations are urged to enhance visibility and detection capabilities within their virtualization environments and adopt a proactive, layered security approach to counter such sophisticated and persistent threats.