ESXi Exploitation in the Wild
In December 2025, Huntress detected an intrusion that resulted in the deployment of VMware ESXi exploits. Based on the observed indicators, including the workstation used by the threat actor and their tactics, the Huntress Tactical Response team concluded with high confidence that the initial access was gained through the SonicWall VPN.
The toolkit analyzed in this report also contained simplified Chinese strings in its development paths, such as a folder named "全版本逃逸--交付" (translated: "All version escape - delivery"), and evidence suggesting it may have been developed as a zero-day exploit over a year before VMware's public disclosure, indicating a well-resourced developer potentially operating in a Chinese-speaking region.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
