This threat involves a sophisticated multi-stage exploit chain targeting VMware ESXi hypervisors, enabling attackers to escape the virtual machine sandbox and gain control over the host system. The attackers, suspected to be Chinese-speaking and well-resourced, initially gained access through a compromised SonicWall VPN appliance. They then deployed an exploit toolkit that weaponizes three zero-day vulnerabilities disclosed by Broadcom in March 2025: CVE-2025-22224 (memory leak in VMX process, CVSS 9.3), CVE-2025-22225 (arbitrary write allowing sandbox escape, CVSS 8.2), and CVE-2025-22226 (memory corruption, CVSS 7.1). The exploit uses a kernel driver (MyDriver.sys) loaded via an open-source utility (KDU) to disable VMware guest VMCI drivers and write multiple shellcode payloads into VMX memory. These payloads enable environment preparation, sandbox escape, and deployment of a 64-bit ELF backdoor (VSOCKpuppet) that communicates over VSOCK port 10000, a channel invisible to traditional network monitoring. A Windows client plugin (GetShell) dropped inside guest VMs allows attackers to remotely execute commands and transfer files between the VM and ESXi host. The attack chain demonstrates advanced techniques including information leakage, memory corruption, and sandbox escape, culminating in full hypervisor compromise. The stealthy nature and use of VSOCK for backdoor communication complicate detection and mitigation. Huntress detected and halted the attack in December 2025 before ransomware deployment, highlighting the threat's potential for severe impact. The presence of simplified Chinese strings and early development dates suggest a Chinese-speaking threat actor with significant capabilities. This attack vector is especially dangerous as it undermines the fundamental isolation guarantees of virtualization environments, threatening confidentiality, integrity, and availability of hosted workloads.

For European organizations, this threat poses a critical risk to data centers and cloud environments relying on VMware ESXi virtualization. Successful exploitation can lead to full hypervisor compromise, enabling attackers to bypass VM isolation, access sensitive data across multiple VMs, and deploy ransomware or other malicious payloads at the host level. This can result in widespread service disruption, data breaches, and loss of trust. The use of VSOCK for stealthy communication makes detection difficult, increasing the risk of prolonged undetected intrusions. Organizations in sectors with high virtualization adoption such as finance, telecommunications, government, and critical infrastructure are particularly vulnerable. The initial access vector via SonicWall VPN appliances also highlights risks in remote access infrastructure, which is widely used across Europe. The attack's sophistication and stealth indicate a threat actor capable of targeted, persistent campaigns, potentially impacting national security and critical services. The lack of patches at the time of detection and the zero-day nature of the vulnerabilities further exacerbate the risk, requiring urgent attention to monitoring and mitigation.

European organizations should immediately audit and secure their SonicWall VPN appliances, ensuring firmware is up to date and access credentials are hardened or rotated. Network segmentation should be enforced to limit VPN appliance access to critical virtualization infrastructure. VMware ESXi hosts must be monitored closely for signs of VMCI and VSOCK anomalies, including unusual driver loads or unexpected network traffic on VSOCK port 10000. Deploy host-based intrusion detection systems capable of monitoring kernel driver loads and VMX process integrity. Implement strict controls on administrative privileges within guest VMs to reduce risk of privilege escalation. Use endpoint detection and response (EDR) tools on guest VMs to detect suspicious binaries such as 'exploit.exe' or 'client.exe' and monitor for file transfers involving ZIP archives like 'Binary.zip'. Employ threat hunting focused on memory corruption and sandbox escape indicators. Where possible, apply VMware patches as soon as they become available and consider temporary compensating controls such as disabling VMCI drivers if feasible. Regularly review logs for VMCI messages and VMX process behavior. Finally, conduct tabletop exercises simulating hypervisor escape scenarios to improve incident response readiness.