China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual Machines
Summary: Huntress observed activity in December 2025, suspected to be Chinese-speaking threat actors, that used a compromised SonicWall VPN appliance as initial access to deploy a VMware ESXi exploit toolkit, stopping it before it reached a possible ransomware stage. The toolkit chained three VMware vulnerabilities disclosed as zero-days by Broadcom in March 2025 - CVE-2025-22224 (CVSS 9.3), CVE-2025-22225 (CVSS 8.2), and CVE-2025-22226 (CVSS 7.1) - and its development paths contain simplified Chinese strings, with evidence suggesting it was built as a zero-day over a year before public disclosure.
Bottom line: The toolkit's VSOCK backdoor channel bypasses traditional network monitoring entirely, and Huntress assesses with high confidence that a Chinese-speaking developer is selling it privately to vetted buyers rather than on public forums - meaning the organizations most likely to face it may never see a signature for it.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-22224CVE-2025-22225CVE-2025-22226
- Related
- CVE-2025-22224: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability Known Exploited Vulnerabilities · Mar 04, 2025CVE-2025-22225: VMware ESXi Arbitrary Write Vulnerability Known Exploited Vulnerabilities · Mar 04, 2025CVE-2025-22226: VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability Known Exploited Vulnerabilities · Mar 04, 2025