VMware ESXi zero-days likely exploited a year before disclosure

Huntress analyzed December 2025 intrusions where attackers — likely Chinese-speaking and using a compromised SonicWall VPN and Domain Admin credentials — deployed a sophisticated VMware ESXi exploit toolkit that leverages (and appears to predate) three VMware zero-days to escape guest VMs, install a hypervisor-level VSOCK backdoor (VSOCKpuppet), and stage exfiltration; artifacts (PDB paths, language usage) suggest development in 2023–2024 and a modular toolset that could be reused against new vulnerabilities, and researchers recommend applying ESXi updates and using YARA/Sigma detection rules.