9th January 2026 Cyber Update: Chinese-Linked Hackers Exploit VMware Zero-Days to Escape Virtual Machines

Update: Cybersecurity firm Huntress has uncovered a sophisticated attack campaign targeting VMware ESXi, leveraging a trio of vulnerabilities (CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226) to escape from a guest virtual machine and seize control of the underlying hypervisor. The attack, observed in December 2025, began with initial access through a compromised SonicWall VPN.

The threat actor, assessed to be a well-resourced Chinese-speaking group, then moved laterally to a domain controller and deployed a custom toolkit. This toolkit, which includes components named "MAESTRO" and "VSOCKpuppet," was likely developed as far back as February 2024, more than a year before VMware disclosed and patched the zero-day flaws in March 2025.

The exploit chain is complex, involving the disabling of VMware's own communication drivers, loading a malicious unsigned kernel driver, and using a combination of memory leak and arbitrary write vulnerabilities to break out of the VMX sandbox and establish a persistent backdoor on the ESXi host. This backdoor communicates over Virtual Sockets (VSOCK), a method that bypasses traditional network monitoring, making detection extremely difficult.

Why it Matters: This incident is a stark reminder that virtualisation does not equal isolation. The ability for an attacker to "escape" a virtual machine and compromise the hypervisor effectively dismantles the security architecture of a modern data center, exposing every other virtual machine on that host to compromise.

The attack demonstrates a level of sophistication and long-term planning characteristic of nation-state actors, who possess the resources to discover and weaponise zero-day vulnerabilities long before they are known to the public. The initial access vector—a compromised VPN—also highlights that even the most advanced attacks often begin by exploiting basic security hygiene failures.

With over 30,000 ESXi instances still exposed to the internet and potentially vulnerable, this campaign represents a significant and ongoing threat to enterprise and government networks, reinforcing the critical need for aggressive patching, network segmentation, and hypervisor-level security monitoring.