Huntress Details ESXi Escape Toolkit and VSOCK Backdoor Used in Intrusion
Summary
Huntress analyzes an ESXi escape toolkit observed in a December 2025 intrusion, detailing its suspected use of three VMware vulnerabilities, a VSOCK backdoor, and the response that stopped the attack before ransomware deployment.
Key points
- Huntress assesses with high confidence that the intrusion began through a compromised SonicWall VPN; attackers used a compromised Domain Admin account to move laterally.
- The toolkit disabled VMCI drivers, used KDU to load an unsigned driver, and exploited ESXi from a guest VM to reach the hypervisor.
- Huntress assesses with moderate confidence that the toolkit leverages CVE-2025-22226, CVE-2025-22224, and CVE-2025-22225.
- The VSOCKpuppet backdoor enabled file transfer and shell commands over VSOCK, traffic that traditional network monitoring may not see.
- Huntress says its response team and SOC stopped the intrusion; the article says the activity could have led to ransomware, but does not report ransomware deployment.
- PDB paths suggest the toolkit may have been developed before VMware's public disclosure; Huntress describes the developer's likely region but says it has no evidence linking the toolkit to a specific organization.
- Huntress recommends promptly patching ESXi 7.0 and 8.0, notes that ESXi 6.x and earlier are end-of-life, and advises monitoring ESXi hosts for open VMCI sockets.
Article Details
- Attack Vectors
- Huntress assessed with high confidence that initial access occurred through a compromised SonicWall VPN.
- The intruder used a compromised Domain Admin account to move laterally to backup and primary domain controllers via RDP.
- On the primary domain controller, the toolkit disabled VMware VMCI devices and used KDU with a signed but vulnerable driver to load the unsigned MyDriver.sys exploit driver into kernel memory.
- The toolkit used HGFS for an information leak, VMCI memory operations, and shellcode to escape the VMX sandbox and gain access to the ESXi host; Huntress assessed with moderate confidence that the chain leveraged CVE-2025-22226, CVE-2025-22224, and CVE-2025-22225.
- Shellcode installed the VSOCKpuppet backdoor on ESXi and configured inetd to execute it as root on port 21; the configuration was restored after activation.
- VSOCKpuppet listened on VSOCK port 10000 and supported file upload, file download, and shell-command execution; the GetShell Plugin client connected from a VM on the host.
- The intruder attempted to change the Domain Admin password using Impacket, modified Windows firewall rules to block external outbound traffic while allowing internal connectivity, and staged data using WinRAR.
- Defensive Notes
- Apply the latest patches to ESXi 7.0 and 8.0. The article states that ESXi 6.x and earlier are end-of-life and remain unpatched.
- Monitor ESXi hosts directly for unusual processes and open VMCI sockets using lsof -a; the article warns that VSOCK traffic is not visible to traditional network monitoring tools.
- Monitor for known vulnerable drivers being loaded and for KDU execution or unsigned-driver loading that bypasses Driver Signature Enforcement.
- Review for unexpected changes to Windows firewall rules that block external outbound access while preserving internal connectivity.
- The article notes that the exploit toolkit supports 155 ESXi builds spanning versions 5.1 through 8.0.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 2bc5d02774ac1778be22cace51f9e35fe7b53378f8d70143bf646b68d2c0f94c | Additional SHA-256 hash listed for Binary.zip, an archive containing attacker tooling. |
| SHA256 | 37972a232ac6d8c402ac4531430967c1fd458b74a52d6d1990688d88956791a7 | SHA-256 hash identified in the article for the MAESTRO exploit.exe payload. |
| SHA256 | 4614346fc1ff74f057d189db45aa7dc25d6e7f3d9b68c287a409a53c86dca25e | SHA-256 hash identified in the article for the GetShell Plugin client.exe. |
| SHA256 | c3f8da7599468c11782c2332497b9e5013d98a1030034243dfed0cf072469c89 | SHA-256 hash identified in the article for the VSOCKpuppet backdoor. |
| SHA256 | dc5b8f7c6a8a6764de3309279e3b6412c23e6af1d7a8631c65b80027444d62bb | SHA-256 hash listed for Binary.zip, an archive containing attacker tooling. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe intruder moved laterally to the backup and primary domain controllers via RDP.T1046 · Network Service DiscoveryAdvanced Port Scanner and SoftPerfect Network Scanner were deployed during reconnaissance.T1059.004 · Unix ShellVSOCKpuppet executed received shell commands through /bin/sh on the ESXi host.T1068 · Exploitation for Privilege EscalationKDU exploited a vulnerability in a signed driver to gain kernel code execution and load the unsigned exploit driver; the toolkit also used an ESXi VM escape chain to reach the host kernel.T1078.002 · Domain AccountsThe intruder used a compromised Domain Admin account to access both domain controllers.T1133 · External Remote ServicesHuntress assessed with high confidence that the intruder gained initial access through a compromised SonicWall VPN.T1135 · Network Share DiscoveryShareFinder was executed to enumerate network shares.T1547.006 · Kernel Modules and ExtensionsKDU manually mapped the unsigned MyDriver.sys exploit driver into kernel memory using a vulnerable signed driver.T1560.001 · Archive via UtilityThe intruder used WinRAR to archive data from a mapped network share for staging.T1562.004 · Disable or Modify System FirewallThe intruder modified Windows firewall rules to block external outbound traffic while allowing internal network connectivity.
CVE
CVE-2025-22224CVE-2025-22224 (CVSS 9.3): A TOCTOU vulnerability in VMCI leading to an out-of-bounds write, allowing code execution as the VMX processCVE-2025-22225CVE-2025-22225 (CVSS 8.2): An arbitrary write vulnerability in ESXi that allows escaping the VMX sandbox to the kernelCVE-2025-22226CVE-2025-22226 (CVSS 7.1): An out-of-bounds read in HGFS that allows leaking memory from the VMX process
People
Malware
Vendors
HuntressIn December 2025, Huntress observed an intrusion leading to the deployment of VMware ESXi exploits.MicrosoftThe TA attempted to change the DA password to Password01$ via Impacket, but the attempt was prevented by Huntress managed Microsoft Defender for Endpoint (MDE).SonicWallthe Huntress Tactical Response team assesses with high confidence that initial access occurred via SonicWall VPN.VMwareIn December 2025, Huntress observed an intrusion leading to the deployment of VMware ESXi exploits.
Products
Microsoft Defender for EndpointThe TA attempted to change the DA password to Password01$ via Impacket, but the attempt was prevented by Huntress managed Microsoft Defender for Endpoint (MDE).SonicWall VPNthe Huntress Tactical Response team assesses with high confidence that initial access occurred via SonicWall VPN.VMware ESXiIn December 2025, Huntress observed an intrusion leading to the deployment of VMware ESXi exploits.
Tools
GetShell PluginThat's where client.exe or GetShell Plugin comes in (found in Binary archive dropped by the threat actor), a simple Windows-based VSOCK client that provides interactive shell access to the backdoor.ImpacketThe TA attempted to change the DA password to Password01$ via Impacket, but the attempt was prevented by Huntress managed Microsoft Defender for Endpoint (MDE).KDUThe use of KDU to load unsigned drivers bypasses Driver Signature Enforcement.MAESTROexploit.exe (MAESTRO) orchestrates the VM escape attack and installs a backdoor on the ESXi hypervisorShareFinderThe TA then executed ShareFinder to enumerate network shares, outputting the results to C:\ProgramData\shares.txt.SoftPerfect Network ScannerC:\Program Files\SoftPerfect Network Scanner\netscan.exe