Full Report
Huntress outlines a complex, multi-step attack designed to break out of guest VMs and target the ESXi hypervisor, using potential zero-day vulnerabilities and sneaky VSOCK communication.
Analysis Summary
# Incident Report: The Great VM Escape (ESXi Exploitation)
## Executive Summary
In December 2025, Huntress identified a sophisticated intrusion involving a VM escape exploit targeting VMware ESXi hypervisors. The threat actor leveraged compromised VPN credentials to pivot to Domain Controllers and deployed a specialized toolkit to break out of guest virtual machines, potentially using zero-day vulnerabilities. The attack was intercepted by the Huntress SOC before reaching its likely conclusion as a ransomware deployment.
## Incident Details
- **Discovery Date:** December 2025
- **Incident Date:** December 2025
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Likely Chinese-speaking region (based on developer strings)
## Timeline of Events
### Initial Access
- **Date/Time:** December 2025
- **Vector:** Likely SonicWall VPN exploitation.
- **Details:** The threat actor gained access via a compromised VPN account, potentially bypassing MFA or utilizing a zero-day vulnerability in the SonicWall service.
### Lateral Movement
- **RDP Pivot:** The actor used a compromised Domain Admin (DA) account to move via RDP to the Backup Domain Controller.
- **Credential Manipulation:** Attempted to change DA passwords using Impacket (blocked by MDE).
- **Domain Dominance:** Moved to the Primary Domain Controller to stage the hypervisor escape toolkit.
### Data Exfiltration/Impact
- **Staging:** Data was staged for exfiltration using WinRAR on the Primary Domain Controller.
- **Isolation:** The attacker modified Windows Firewall rules to block external outbound traffic (preventing security tool "phone-home") while allowing internal lateral movement.
### Detection & Response
- **Discovery:** Huntress managed Microsoft Defender for Endpoint (MDE) detected unauthorized password reset attempts.
- **Response:** Huntress Tactical Response team and SOC intervened to block the execution of the ESXi exploit and contain the compromised Domain Controllers.
## Attack Methodology
- **Initial Access:** SonicWall VPN compromise.
- **Persistence:** High-level Domain Admin account access.
- **Privilege Escalation:** Domain Admin rights utilized to disable security drivers.
- **Defense Evasion:** Modified Windows Firewall to isolate hosts; used Kernel Driver Utility (KDU) to load unsigned drivers; disabled VMCI devices.
- **Credential Access:** Attempted password resets via Impacket.
- **Discovery:** Used `Advanced_Port_Scanner`, `netscan.exe`, and `ShareFinder`.
- **Lateral Movement:** RDP and SMB/Impacket.
- **Collection:** Data compression via WinRAR.
- **Exfiltration:** Staged for outbound transfer (thwarted).
- **Impact:** Target was ESXi hypervisor breakout to compromise all guest workloads.
## Impact Assessment
- **Financial:** Prevented potential multi-million dollar ransomware demand.
- **Data Breach:** Staging occurred, but exfiltration was interrupted.
- **Operational:** Temporary disruption due to host isolation and remediation.
- **Reputational:** High risk if hypervisor workloads were fully compromised.
## Indicators of Compromise
- **File indicators:**
- `Advanced_Port_Scanner_2.5.3869.exe`
- `netscan.exe`
- `kdu.exe`
- `MyDriver.sys` (Unsigned exploit driver)
- **Behavioral indicators:**
- `netsh` commands blocking `0.0.0.0-255.255.255.255` outbound.
- Disabling of PCI devices: `PCI\VEN_15AD&DEV_0740` (VMware VMCI).
- Use of `lsof -a` on ESXi to find unusual VSOCK communications.
## Response Actions
- **Containment:** Isolated infected Domain Controllers and revoked VPN credentials.
- **Eradication:** Removed exploit toolkits and malicious firewall rules; killed unauthorized RDP sessions.
- **Recovery:** Restoration of secure DA credentials and patching of VPN/ESXi systems.
## Lessons Learned
- **VPN Risks:** Even sophisticated hypervisor attacks often start with "boring" initial access vectors like unpatched or poorly secured VPNs.
- **Hypervisor Blind Spots:** Standard network firewalls cannot see VSOCK traffic between a VM and its host, creating a monitoring gap.
- **BYOD (Bring Your Own Driver):** Attackers are increasingly using utilities like KDU to bypass Windows Driver Signature Enforcement.
## Recommendations
- **Patch Management:** Aggressively patch ESXi hosts; decommission EOL versions (5.1–6.7) as they remain vulnerable to this toolkit.
- **VPN Hardening:** Implement strict IP allow-listing for VPN management interfaces and ensure robust MFA.
- **Hypervisor Monitoring:** Monitor ESXi hosts directly for unusual processes and hardware configuration changes (e.g., VMCI device disabling).
- **Driver Integrity:** Enable Hypervisor-Protected Code Integrity (HVCI) to prevent the loading of unsigned or known-vulnerable drivers.