Unveiling the Year-Long VMware ESXi Zero-Day Exploit

Chinese Threat Actors and a Year-Long Exploit

A recent report by Huntress has shed light on a sophisticated attack campaign involving Chinese-speaking threat actors who exploited VMware ESXi vulnerabilities more than a year before they were publicly disclosed. The attackers used a compromised SonicWall VPN appliance to deliver an exploit toolkit, providing insights into a potentially long-term attack strategy.

The Exploit Toolkit: A Closer Look

The toolkit, which appears to have been developed since February 2024, consists of several components: MAESTRO, MyDriver.sys, VSOCKpuppet, and GetShell Plugin. These components work together to enable a virtual machine (VM) escape, gain access to the underlying hypervisor, and establish a backdoor for command execution and file transfer.

MAESTRO: The Orchestrator

MAESTRO coordinates the VM escape by disabling VMware VMCI devices, loading the unsigned exploit driver, monitoring exploit success, and restoring drivers afterward.

MyDriver.sys: The Kernel Driver

MyDriver.sys is an unsigned kernel driver that executes the VM escape, including ESXi version detection, memory leakage and corruption, sandbox escape, and the deployment of a hypervisor backdoor.

VSOCKpuppet: The ESXi Backdoor

VSOCKpuppet is an ELF backdoor running on the ESXi host, providing command execution and file transfer over VSOCK, bypassing traditional network monitoring.

GetShell Plugin: The Windows VSOCK Client

GetShell Plugin is a Windows VSOCK client used to connect from a guest VM to the compromised ESXi host and interact with the VSOCKpuppet backdoor.

Implications for North East India and Beyond

As organizations in North East India increasingly adopt virtualization technologies, understanding and addressing zero-day exploits becomes crucial to maintain the security of critical infrastructure. The recent VMware ESXi exploit serves as a reminder of the need for vigilance and proactive security measures.

A Modular Approach to Exploitation

Huntress believes that the threat actor behind this attack may have a modular approach, separating post-exploitation tools from the exploits. This allows them to use the same infrastructure and switch to new vulnerabilities, making it challenging for security teams to stay ahead.

Looking Forward

As the cybersecurity landscape continues to evolve, it is essential for organizations to stay informed about emerging threats and adopt best practices to protect their systems. In this case, Huntress recommends applying the latest ESXi security updates and using provided YARA and Sigma rules for early detection.