Loading malware…
MyDriver.sys is an unsigned Windows kernel driver used as part of the MAESTRO VMware ESXi VM-escape exploit toolkit observed by Huntress in a December 2025 intrusion. The driver was loaded via kdu.exe to bypass Driver Signature Enforcement and was embedded as a resource within the MAESTRO orchestrator alongside kdu.exe, devcon.exe, and drv64.dll. Huntress described it as an unsigned kernel driver containing the VM escape exploit.
Operationally, the toolkit used devcon.exe to disable VMware VMCI-related devices (PCI\VEN_15AD&DEV_0740 and ROOT\VMWVMCIHOSTDEV), after which MyDriver.sys communicated directly with VMCI hardware registers using x86 IN/OUT instructions to avoid contention with vmci.sys. The driver queried the ESXi host version using the VMware Guest SDK command "guestlib.stat.get text session" and parsed the ESXi build string. The exploit supported 155 ESXi builds spanning versions 5.1 through 8.0 using build-specific offsets.
Based on Huntress’s assessment, the broader exploit chain likely leveraged VMware vulnerabilities CVE-2025-22226, CVE-2025-22224, and CVE-2025-22225 from VMSA-2025-0004. The chain used HGFS drag-and-drop related RPC commands to leak VMX memory and defeat ASLR, corrupted VMX memory via VMCI, and then escaped the VMX sandbox to the ESXi kernel. It wrote stage-1 and stage-2 shellcode plus the Linux ELF backdoor VSOCKpuppet into VMX memory, ultimately deploying the backdoor on the ESXi host. VSOCKpuppet bound to VSOCK port 10000 and supported file read/write and arbitrary shell command execution via /bin/sh. A Windows VSOCK client (client.exe, also called "GetShell Plugin") was used from a guest VM to communicate with the ESXi backdoor.
The malware was associated with an intrusion that likely began through a compromised SonicWall VPN, followed by lateral movement using a compromised Domain Admin account, RDP access to domain controllers, share enumeration with ShareFinder, attempted password changes via Impacket, and firewall modifications to block outbound external connectivity while preserving internal RFC1918 access. Huntress noted simplified Chinese development artifacts and PDB evidence suggesting development as early as February 19, 2024, indicating a well-resourced developer likely operating in a Chinese-speaking region, though no specific threat actor attribution was provided. The intrusion was stopped before it culminated in ransomware.
Known IOC directly associated with MyDriver.sys: SHA-256 2bc5d02774ac1778be22cace51f9e35fe7b53378f8d70143bf646b68d2c0f94c.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-22225 (8.2 severity score): An arbitrary write vulnerability in ESXi that allows escaping the VMX sandbox to the kernel
Of the three bugs, only one received a critical severity score: CVE-2025-22226 (7.1 severity score): An out-of-bounds read in HGFS that allows leaking memory from the VMX process
CVE-2025-22224 (9.3 severity score): A TOCTOU vulnerability in Virtual Machine Communication Interface (VMCI) leading to an out-of-bounds write, allowing code execution as the VMX process
2 distinct techniques documented for this family, organized by ATT&CK tactic.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious Windows driver associated with VMware ESXi exploitation campaigns.
Unsigned Windows kernel driver that performs the core VM-escape exploitation: gathers ESXi build info, uses HGFS-related backdoor operations for an info leak to derive VMX base (ASLR bypass), manipulates VMCI hardware and VMX memory to write/trigger shellcode, and deploys the ESXi payload (VSOCKpuppet). Contains a hardcoded table supporting 155 ESXi builds (5.1–8.0) with version-specific offsets.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.