Unknown Chinese Threat Actor

An unidentified Chinese-speaking threat actor assessed to be well resourced developed and used a VMware ESXi exploit toolkit for the vulnerabilities CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, collectively known as ESXicape. Available evidence indicates the toolkit was created well before public disclosure of the vulnerabilities and was engineered to support a broad range of ESXi versions, including legacy and end-of-life builds. The exploit enables a privileged attacker to escape from a guest virtual machine and execute code on the ESXi hypervisor, after which the actor deployed a hypervisor-level backdoor. In observed intrusion activity, the actor obtained initial access through a compromised VPN appliance, abused domain administrator privileges, accessed the primary domain controller, modified firewall settings to disrupt victim connectivity, collected data for exfiltration, and then deployed the ESXi exploit toolkit. The intrusion chain demonstrates capabilities spanning initial access, privilege abuse, post-exploitation, persistence on virtualization infrastructure, defense evasion, and data theft. Reporting indicates at least one observed operation likely involved ransomware, but the actor has not been publicly tied to a named ransomware program or stable cluster alias beyond being an unidentified Chinese-speaking operator. The actor’s demonstrated tradecraft suggests a focus on high-value enterprise environments running VMware virtualization infrastructure and an ability to operationalize zero-day or pre-disclosure exploit capability over an extended period.