Chinese-speaking hackers exploited ESXi zero-days long before disclosure

Chinese-speaking attackers used a hacked SonicWall VPN to deliver a VMware ESXi exploit toolkit, with the intrusion first detected in December 2025 and attributed to a compromised VPN. The attackers reportedly developed the exploit chain more than a year before VMware’s public disclosure, suggesting long-term covert exploitation of unknown flaws and early knowledge of three ESXi zero-days later disclosed in March 2025.

Huntress researchers described evidence such as simplified Chinese strings and build paths in the toolkit, and noted that the MAESTRO orchestrator managed a full ESXi VM escape, disabling VMCI drivers and loading an unsigned exploit driver via BYOD techniques.

The chain leaks VMX memory to bypass ASLR, abuses HGFS and VMCI flaws, writes shellcode into the VMX process, and escapes to the ESXi kernel, deploying a stealthy VSOCK-based backdoor for persistent remote control from guest VMs before detection halted the operation. VMware’s advisory VMSA‑2025‑0004 fixed three zero-days: CVE-2025-22226 (out-of-bounds read), CVE-2025-22224 (TOCTOU leading to out-of-bounds write), and CVE-2025-22225 (arbitrary write).

This analysis, according to Huntress, indicates a well-resourced actor potentially operating in a Chinese-speaking region, with development timelines dating back to February 2024.