MAESTRO Toolkit Exploiting VMware VM Escape Vulnerabilities

In December 2025 Huntress researchers disclosed the MAESTRO toolkit that enabled VM escapes from guest VMs to VMware ESXi hosts by exploiting multiple zero-day vulnerabilities (fixed March 4, 2025). The attackers gained access via stolen SonicWall VPN credentials, targeted the VMX process, used VSOCK for stealth communications, and operated a cross-version exploit covering VMware 5.1 through 8.0; artifacts and simplified Chinese notes suggest a well-resourced, likely Chinese-speaking developer. Organizations are advised to patch immediately and search hosts for signs of compromise.