<h1>Overview</h1>
<p>Chinese-speaking threat actors have been exploiting a series of sophisticated zero-day vulnerabilities in VMware ESXi (identified as CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) to gain control over hypervisors by escaping virtual machines. These exploits were discovered to be in use more than a year before VMware’s public disclosure in March 2025, with development evidence dating back to February 2024.</p>
<h1>Initial Access and Exploitation</h1>
<p>The attack chain commenced with compromised access to SonicWall VPNs, allowing the attackers to escalate privileges to Domain Admin levels. Once inside, they deployed a multi-stage toolkit named MAESTRO. This toolkit was instrumental in disabling the VMCI drivers and loading unsigned kernel exploits, effectively bypassing VM isolation protocols.</p>
<h1>Tools and Techniques</h1>
<p>MAESTRO included a VSOCK-based backdoor, providing a persistent channel for the attackers to communicate directly between the virtual machine and the hypervisor, thus eluding traditional network monitoring systems. It is reported that the toolkit supported over 150 different ESXi builds, emphasizing the adaptability and broad reach of these threats.</p>
<h1>Indicators of Sophistication</h1>
<p>Researchers from Huntress, who uncovered these activities, identified the presence of simplified Chinese language strings within the toolkit, suggesting development by well-resourced actors from a Chinese-speaking region. The toolkit’s sophistication, alongside its early development, indicates substantial resource backing and highlights significant premeditation in orchestrating these attacks.</p>
<h1>Implications and Recommendations</h1>
<p>The early exploitation of these zero-days underscores the necessity for organizations to implement robust security measures, including regular patching of known vulnerabilities and enhanced scrutiny of network access points. As hypervisors continue to be a critical component in virtual environments, securing these assets is paramount in mitigating potential attack vectors.</p>


Collections

Chinese-speaking threat actors exploited three VMware ESXi zero-day vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) over a year before public disclosure, gaining hypervisor control by escaping virtual machines. The attackers used compromised SonicWall VPNs for initial access, escalated to Domain Admin privileges, and deployed MAESTRO—a sophisticated toolkit supporting 150+ ESXi builds with VSOCK-based backdoors for persistent communication. The toolkit's simplified Chinese strings and early development (February 2024) indicate well-resourced, premeditated attacks requiring enhanced security measures and regular patching.

China-Linked Hackers Exploit VMware ESXi Zero-Days for Hypervisor Control