The Great VM Escape: ESXi Exploitation in the Wild
Summary
Huntress analyzes a December 2025 ESXi VM escape intrusion, detailing the exploit chain (VM escape through ESXi, HGFS vulnerability, VMCI, and kernel driver loading), the CVEs involved, observed indicators, and practical patching and detection recommendations. The piece highlights detection challenges via VSOCK and provides IOCs and Sigma/Yara signatures for defenders.