Hackers Actively Exploit VMware ESXi Instances Using Zero-Day Exploit Toolkit

Security researchers at Huntress have uncovered a sophisticated attack campaign targeting VMware ESXi instances through a zero-day exploit toolkit dubbed MAESTRO.

The toolkit chains multiple critical vulnerabilities to achieve virtual machine escape, allowing threat actors to break out of guest environments and gain control of host systems.

The discovery highlights escalating threats to virtualized infrastructure, particularly as attackers increasingly target hypervisor security for ransomware operations.

In a real-world attack disrupted by Huntress, threat actors gained initial access via a compromised SonicWall VPN appliance and laterally pivoted using stolen Domain Admin credentials.

Upon reaching the primary domain controller, attackers deployed reconnaissance tools, including Advanced Port Scanner and ShareFinder, to map the environment.

They staged data using WinRAR and deliberately modified Windows firewall rules, blocking external outbound connections while permitting internal lateral movement, a tactic designed to maintain stealth while preserving command-and-control capabilities.

The MAESTRO toolkit executed approximately 20 minutes after deployment on the domain controller. It systematically disabled VMware VMCI drivers using devcon.exe, then loaded an unsigned kernel driver via KDU to circumvent Driver Signature Enforcement, a Windows security mechanism.

The toolkit’s core component, MyDriver.sys, uses the Guest SDK to detect ESXi versions and selects matching memory offsets from a table that supports 155 builds spanning ESXi 5.1 through 8.0.

The exploitation chain utilizes three distinct zero-day vulnerabilities to achieve sandbox escape. The toolkit first leaks virtual machine memory through CVE-2025-22226, then corrupts kernel memory to escalate privileges via CVE-2025-22224 and CVE-2025-22225.

Once an escape is achieved, attackers deploy VSOCKpuppet, a sophisticated backdoor that hijacks ESXi’s inetd service on port 21, enabling root-level command execution.

Critically, the backdoor leverages VSOCK for covert guest-to-host communication, rendering it invisible to standard network monitoring tools.

CVE Summary Table

CVE ID	CVSS Score	Vulnerability Type	Impact
CVE-2025-22226	7.1	Out-of-bounds Read	Memory disclosure from HGFS leaking VMX base address
CVE-2025-22224	9.3	Arbitrary Write	Kernel privilege escalation from guest context
CVE-2025-22225	8.2	Arbitrary Write	Sandbox escape enabling host system compromise

Forensic analysis of PDB debug symbols reveals that development occurred in simplified Chinese environments, with artifacts dated February 2024, more than a year before Broadcom’s official vulnerability disclosure in March 2025.

Additional client tool artifacts reference “XLab” and carry November 2023 timestamps, suggesting modular, well-resourced adversary infrastructure.

The attack demonstrates how hypervisor vulnerabilities fundamentally undermine VM isolation guarantees.

Huntress researchers recommend organizations immediately patch ESXi systems, as end-of-life versions receive no security updates.

Detection requires monitoring for VSOCK processes using network utilities, scrutinizing suspicious kernel drivers, and securing VPN appliances against initial compromise.

The incident underscores why virtualization security now demands enterprise-grade attention alongside traditional network defenses.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.