Cybercriminals Exploit VMware ESXi Vulnerabilities Using Zero-Day Toolset

**Executive summary:** Huntress researchers uncovered the MAESTRO ESXi exploitation campaign that began with a compromised SonicWall VPN and stolen Domain Admin credentials, chained three VMware vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) to escape the VMX sandbox to kernel level, used KDU to load unsigned drivers, and deployed a VSOCK-based backdoor that evades conventional network monitoring; PDB paths with simplified Chinese and support for 155 ESXi builds indicate a well-resourced Chinese-language developer, and the report provides file-hash IOCs and hardening recommendations including immediate patching and monitoring for unusual VSOCK processes.