{"id":59977,"date":"2026-01-09T13:28:38","date_gmt":"2026-01-09T13:28:38","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/china-linked-cybercrims-abused-vmware-esxi-zero-days-a-year-before-disclosure\/"},"modified":"2026-01-09T13:28:38","modified_gmt":"2026-01-09T13:28:38","slug":"china-linked-cybercrims-abused-vmware-esxi-zero-days-a-year-before-disclosure","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/china-linked-cybercrims-abused-vmware-esxi-zero-days-a-year-before-disclosure\/","title":{"rendered":"China-linked cybercrims abused VMware ESXi zero-days a year before disclosure"},"content":{"rendered":"

Chinese-linked cybercriminals were sitting on a working VMware ESXi hypervisor escape kit more than a year before the bugs it relied on were made public.<\/p>\n

That’s according to researchers at Huntress, who this week published a breakdown<\/a> of an intrusion they observed in December 2025 in which a “sophisticated” toolkit was used to break out of virtual machines and target the ESXi hypervisor itself. The security firm says parts of the code point to development starting as early as February 2024 \u2013 a full year before VMware disclosed the bugs in March 2025.<\/p>\n

The incident began in a very unglamorous way \u2013 with a compromised SonicWall VPN appliance. From there, the attackers were able to commandeer a Domain Admin account, pivot across the network, and eventually deploy a suite of tools that Huntress says exploited multiple flaws to escape a guest VM and reach the underlying ESXi hypervisor.<\/p>\n