MyDriver.sys Kernel Driver is a tool tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed January 9, 2026; most recent activity January 9, 2026.
MyDriver.sys is described as a Windows kernel-mode driver used by threat actors as part of an exploit toolkit to achieve privileged code execution and driver-level manipulation. In the context of VMware ESXi, it functions as a kernel-level component leveraged to enable stealthy exploitation and persistence across virtualization infrastructure. Its significance lies in its ability to operate at the kernel level, potentially bypassing user-mode defenses and facilitating complex attack chains targeting ESXi environments.
Chinese-speaking threat actors conducted attacks using a VMware ESXi exploit toolkit that leveraged three zero-day vulnerabilities, identified as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226. The initial access…