{
  "id": 11110952,
  "title": "ESXi Exploitation in the Wild",
  "url": "https://urgent.news/2026/10/01/esxi-exploitation-in-the-wild",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-01T02:30:14.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://www.huntress.com/blog/esxi-vm-escape-exploit"
  },
  "original_language": "en",
  "account": "In December 2025, Huntress detected an intrusion that resulted in the deployment of VMware ESXi exploits. Based on the observed indicators, including the workstation used by the threat actor and their tactics, the Huntress Tactical Response team concluded with high confidence that the initial access was gained through the SonicWall VPN. The toolkit analyzed in this report also contained simplified Chinese strings in its development paths, such as a folder named \"全版本逃逸--交付\" (translated: \"All version escape - delivery\"), and evidence suggesting it may have been developed as a zero-day exploit over a year before VMware's public disclosure, indicating a well-resourced developer potentially operating in a Chinese-speaking region.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}