BleepingComputer reports that attacks spreading a VMware ESXi exploit toolkit which involved a trio of zero-days that were chained more than a year before their disclosure last March have been conducted by Chinese-speaking threat actors last month.
Initial access provided by a breached SonicWall VPN enabled a subsequent pivot to domain controllers and the execution of an exploit chain involving the ESXi bugs, tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, to allow virtual machine escape, according to Huntress researchers.
Integrated into the exploit toolkit were MAESTRO payload, which deactivates VMware VMCI devices and tracks exploit success to coordinate VM escape; the unsigned MyDriver.sys kernel driver, which allows VM escape execution; the VSOCKpuppet backdoor, which enables clandestine command execution and file transfers; and the GetShell plugin, which establishes a connection between the breached ESXi host and the guest VM.
Organizations have been urged to implement the latest ESXi updates, while using YARA and Sigma rules for improved threat detection.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
