CHINA-LINKED HACKERS EXPLOIT VMWARE ESXI ZERO-DAYS TO ESCAPE VIRTUAL MACHINES

Summary from the TLDR InfoSec newsletter

Huntress observed Chinese-speaking threat actors exploiting three VMware ESXi zero-days (CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226) to escape virtual machine isolation and gain full hypervisor control. Evidence suggests the exploit toolkit was developed as early as February 2024, over a year before Broadcom's March 2025 disclosure. The multi-stage attack chain used a compromised SonicWall VPN for initial access and deployed the VSOCKpuppet backdoor, which communicates over VSOCK to bypass traditional network monitoring entirely. Organizations should prioritize patching these vulnerabilities and monitor for unusual VMCI/VSOCK activity between guest VMs and hypervisors.