“VM Isolation is Not Absolute”: Researchers Unmask Sophisticated ESXi “Maestro” Exploit

According to Huntress, a new report describes a December 2025 intrusion in which threat actors achieved a full VM escape from a guest VM to seize control of the underlying VMware ESXi hypervisor, challenging the security promises of virtualization.

The attackers allegedly used a zero-day‑style toolkit developed over more than a year before public disclosure, orchestrated by a binary named “MAESTRO” (exploit.exe) and employing a Bring-Your-Own-Vulnerable-Driver technique to load an unsigned driver, MyDriver.sys, into the Windows kernel. The operation disabled VMware drivers to gain direct hardware access and deployed a backdoor named “VSOCKpuppet” that communicates via VSOCK, bypassing traditional network monitoring.

The development timeline suggests the weapon was ready as early as February 2024, with exploits affecting 155 ESXi builds across versions 5.1 through 8.0. The analysis urges organisations to stop relying solely on perimeter defences and to patch ESXi aggressively, warning that unpatched, end-of-life versions leave organisations exposed with no fix available.