{
  "source_id": "mandiant-unc3886-esxi-logging-2023",
  "source_key": "mandiant-unc3886-esxi-logging-2023",
  "title": "VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors",
  "publisher": "Mandiant / Google Cloud",
  "source_url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass",
  "originally_published": null,
  "most_recently_updated": null,
  "first_collected": "2026-10-22T19:50:55+00:00",
  "last_successfully_checked": "2026-10-22T19:50:55+00:00",
  "original_content_digest": "d6d62d6000fa93785bc8ec8434af2ffd2d9a3281c9e7a0e51d48d35361ed4a70",
  "source_publication_date": "2023-06-13",
  "date_precision": "day",
  "affected_platform": "VMware ESXi / vCenter / Windows, Linux and PhotonOS guests",
  "date_note": "Historical original-publisher report. Full publication or update timestamps remain unknown where only a date is supplied. Google published_time metadata may reflect migration and is not promoted to an original publication or update timestamp.",
  "review_decision": "include",
  "reason_codes": [
    "editor-approved",
    "The original report explicitly connects observed logging interference to investigation difficulty and identifies guest-operation visibility limits. It is included for that stated forensic impact, not merely for the associated vulnerability."
  ],
  "editorial_annotation": "Mandiant explicitly describes investigative challenges from disabled or altered logging and guest operations without default guest logs. Treat hypervisor, guest, and central logging as separate coverage questions and preserve surviving sources with their collection limits.",
  "topic": "Virtualization visibility",
  "evidence_quote_reference": {
    "short_quote": "tamper with and disable logging services",
    "section": "Reviewed original report; locate the quoted phrase in context."
  },
  "editor_reviewed": "2026-10-22",
  "historical": true,
  "related_guide_urls": [
    "https://anti-forensics.com/reference/artifacts/windows-event-forwarding-gaps/",
    "https://anti-forensics.com/reference/artifacts/linux-systemd-journal-scope/",
    "https://anti-forensics.com/reference/techniques/recovery-and-absence-claims/"
  ],
  "record_version_digest": "6e12caf17b123dc636201775a8c53145ce5887bddfa6c64e86aadbf3ca7977fa"
}