ESXi Exploitation in the Wild

What it is

A December 2025 Huntress-observed intrusion deploying a VMware ESXi VM-escape toolkit ("MAESTRO"). The summary covers the CVE chain; what it does not carry is the operator's on-host command sequence, the detection guidance, and the attribution evidence. Development paths contain simplified Chinese strings — including a folder named 全版本逃逸--交付 ("All version escape - delivery") — and Huntress assesses the toolkit was likely built as a zero-day over a year before VMware's March 4, 2025 disclosure (VMSA-2025-0004), pointing to a well-resourced Chinese-speaking developer. Confidence on the specific CVE mapping is only moderate.

How it works

The exploit runs from the Windows host managing ESXi, in this order:

devcon.exe disable "PCI\VEN_15AD&DEV_0740"
devcon.exe disable "ROOT\VMWVMCIHOSTDEV"
kdu.exe -prv 1 -map MyDriver.sys
exploit.exe    (MAESTRO)

The two devcon calls disable the VMware VMCI PCI device and host driver for direct hardware access; kdu (Kernel Driver Utility) bypasses Driver Signature Enforcement to map the unsigned MyDriver.sys; then exploit.exe chains HGFS memory leak → VMCI corruption → kernel escape and installs a backdoor on the hypervisor. VMX is the initial target because it processes untrusted guest input (clipboard, drag-and-drop, VMware Tools), but runs sandboxed — hence the second step to reach kernel.

Preconditions / Affected

155 ESXi builds, versions 5.1 through 8.0 — end-of-life versions have no fix. The attackers reached the hypervisor manager via a compromised Domain Admin account over RDP, having first entered through a compromised SonicWall VPN. So this requires prior domain compromise, not remote-unauthenticated exploitation.

What to do

Beyond patching per VMSA-2025-0004, the page gives host-level detection because VSOCK traffic between guest and hypervisor is invisible to firewalls and IDS:

• Monitor ESXi hosts directly for unusual processes using lsof -a.
• Monitor for known-vulnerable drivers being loaded (the KDU BYOVD technique).
• Watch for the attacker's containment/staging moves — netsh firewall rules that block external outbound while permitting internal ranges, and WinRAR staging:

netsh advfirewall firewall add rule "name=Block External Outbound" dir=out action=block remoteip=0.0.0.0-255.255.255.255 profile=any
"C:\Program Files\WinRAR\WinRAR.exe" a -ep1 -scul -r0 -iext -imon1 -- . "Mapped Network Share"

Also note: MDE blocked an Impacket attempt to reset the DA password to Password01$, and recon used Advanced Port Scanner, SoftPerfect netscan, and ShareFinder (output to C:\ProgramData\shares.txt).

Caveats

The CVE mapping is Huntress's moderate-confidence assessment from behavior, not confirmed. Initial-access-via-SonicWall is high confidence but inferred from workstation name and TTPs. The intrusion was stopped before any ransomware payload, so the assessed end goal is inference, not observed.