China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual Machines

According to Huntress, China-speaking threat actors are suspected of using a compromised SonicWall VPN appliance as an initial access vector to deploy a VMware ESXi exploit that may have been developed as far back as February 2024, with activity observed in December 2025 that was halted before reaching the final stage and may have led to a ransomware incident.

The attack is believed to have exploited three VMware vulnerabilities disclosed as zero-days by Broadcom in March 2025: CVE-2025-22224 (CVSS 9.3), CVE-2025-22225 (CVSS 8.2), and CVE-2025-22226 (CVSS 7.1), enabling memory leakage from the VMX process or code execution as the VMX process. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to the Known Exploited Vulnerabilities catalog in the same month, citing evidence of active exploitation.

The toolkit, described by Huntress, includes exploit.exe (aka MAESTRO) and embedded binaries such as devcon.exe and MyDriver.sys, and uses Kernel Driver Utility (KDU) to load an unsigned kernel driver and monitor exploit status, enabling a multi-stage VM escape. It also leverages VSOCK for backdoor communication, with a GetShell Plugin client.exe that can operate from any guest Windows VM on the compromised host.

The analysis notes a flow where the exploit overwrites a VMX function pointer to jump to shellcode, delivering a three-stage payload and a 64-bit backdoor named VSOCKpuppet. The researchers observed indicators such as a folder name in simplified Chinese and suggested a well-resourced developer in a Chinese‑speaking region, but the actors behind the toolkit remain unconfirmed.