UNC5174 VMware privilege-escalation activity

The **UNC5174** operation is actively exploiting **CVE-2025-41244** to gain **root** code execution on VMware-managed virtual machines, increasing risk for organizations using **VMware Aria Operations**, **VMware Tools**, and **open-vm-tools**. The activity has persisted **since October 2024** and uses **malicious binaries in /tmp/httpd** plus discovery-logic abuse to trigger privilege escalation.

A **CVE-2025-41244** exploitation wave has affected **VMware Aria Operations** and **VMware Tools** since **mid-October 2024**, creating **privilege-escalation** risk on vulnerable VMs. Attackers can stage a malicious binary in broadly matched paths and push it into VMware service discovery, which can end in **root-level code execution**. A **proof-of-concept exploit** now shows how the flaw can be abused in both **credential-based** and **credential-less** configurations. The activity matters because it turns a local foothold into full administrative control on exposed systems.

**CVE-2025-41244** is a **local privilege escalation** flaw in **VMware Tools** and **VMware Aria Operations** that can let an unprivileged local user reach **root** on affected virtual machines. **Broadcom** and **NVISO** said the bug was exploited in the wild as a **zero-day** beginning in **mid-October 2024**, with abuse linked to **UNC5174**. The issue affects multiple **VMware** product lines, including **VMware Cloud Foundation**, **VMware vSphere Foundation**, and **Telco Cloud** deployments, and Broadcom said remediation requires **patching** with product-specific updates.