---
title: Chinese Hackers Exploit VMware Flaws to Break Into Isolated Networks
description: Chinese cyberespionage group Fire Ant exploited VMware and F5 vulnerabilities to breach isolated networks, showing persistence and advanced tactics, according to Sygnia.
canonical_url: https://codekeeper.co/ticker/chinese-hackers-exploit-vmware-flaws
---

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# Chinese Hackers Exploit VMware Flaws to Break Into Isolated Networks

Chinese cyberespionage group Fire Ant exploited VMware and F5 vulnerabilities to breach isolated networks, showing persistence and advanced tactics, according to Sygnia.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jul 25, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A Chinese cyberespionage group called Fire Ant has been targeting VMware and F5 vulnerabilities to breach supposedly secure, isolated networks. The hackers exploited critical flaws like CVE-2023-34048 in vCenter Server and CVE-2023-20867 in ESXi to gain complete control over virtualization infrastructure. They then used compromised systems as stepping stones to access guest virtual machines and tunnel between network segments that should've been separated. Cybersecurity firm Sygnia found the group shows remarkable persistence, quickly adapting when defenders try to kick them out by deploying backup backdoors and changing tactics. The attack methods strongly resemble those used by another Chinese group, UNC3886. Source: [SecurityWeek](https://www.securityweek.com/chinese-spies-target-networking-and-virtualization-flaws-to-breach-isolated-environments/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fchinese-hackers-exploit-vmware-flaws%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks McKesson Confirms Breach as ShinyHunters Claims 284 Million Records Sep 7, 2026](https://codekeeper.co/ticker/mckesson-cyberattack-shinyhunters-data-breach)

[Cyberattacks Ex-Soldier Gets 70 Months for AT&T and Verizon Extortion Sep 28, 2026](https://codekeeper.co/ticker/army-soldier-sentenced-for-cybercrime-and-extortion)

[Vulnerabilities CISA Flags ScreenConnect Flaw Exploited Since August Sep 22, 2026](https://codekeeper.co/ticker/cisa-screenconnect-critical-flaw-exploitation)

[Levi Strauss Hit by Social Engineering Cyberattack Aug 11, 2026](https://codekeeper.co/ticker/levi-strauss-data-breach-social-engineering)