TLDR Tech / InfoSec
CVE-2025-22225 in VMware ESXi now used in active ransomware attacks
CISA confirmed that ransomware gangs are actively exploiting CVE-2025-22225 (CVSS 8.2), an arbitrary kernel write vulnerability in VMware ESXi that enables sandbox escape from the VMX process, now added to the KEV catalog as used in ransomware campaigns. Huntress attributed a related exploit chain to Chinese-speaking threat actors using the MAESTRO orchestrator toolkit, which chains CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 to achieve full VM escape and deploy the VSOCKpuppet backdoor for persistent hypervisor control. Organizations running unpatched ESXi should apply VMSA-2025-0004 immediately and audit for signs of unauthorized kernel driver loading or VSOCK-based lateral movement from guest VMs.
Read the full story