20260109-thehackernews.com-4b27f | Perceptive Security

< Back to index

China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual Machines

Published:

9 January 2026 at 17:43:00

Alert date:

9 January 2026 at 20:01:43

Source:

thehackernews.com

Cloud & Virtualization, Zero-Day Vulnerabilities, Ransomware & Malware

Chinese-speaking threat actors exploited a compromised SonicWall VPN appliance to gain initial access and deploy VMware ESXi zero-day exploits for virtual machine escape. The attack was discovered by Huntress in December 2025 and may have been designed to deliver ransomware. The VMware ESXi exploit was potentially developed as early as February 2024, indicating a sophisticated long-term campaign. The attackers successfully compromised the virtualization infrastructure before being stopped in the final stage.

Technical details

Chinese-speaking threat actors leveraged compromised SonicWall VPN appliance as initial access vector to deploy VMware ESXi exploit. Attack chain includes exploit.exe (MAESTRO) orchestrator with embedded binaries: devcon.exe to disable VMCI drivers, MyDriver.sys unsigned kernel driver loaded via KDU tool. Exploits target ESXi version identification and trigger CVE-2025-22226/CVE-2025-22224, writing three payloads to VMX memory: Stage 1 shellcode for environment prep, Stage 2 shellcode for ESXi foothold, VSOCKpuppet 64-bit ELF backdoor for persistent access via VSOCK port 10000. Attack overwrites VMX function pointer and uses VMCI messages to trigger execution. GetShell Plugin (client.exe) enables command execution and file transfer between guest VMs and compromised hypervisor via VSOCK communication.

Mitigation steps:

Apply VMware security patches for CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226. Monitor for VSOCK communications on port 10000. Implement network monitoring for traditional detection bypass attempts. Monitor for unsigned kernel driver loading activities. Check for suspicious VM escape attempts and hypervisor compromise indicators. Ensure SonicWall VPN appliances are properly secured and monitored for compromise.

Affected products:

VMware ESXi
SonicWall VPN appliances