Loading malware…
MyDriver.sys is an unsigned Windows kernel driver used as part of the MAESTRO VMware ESXi VM-escape exploit toolkit observed by Huntress in a December 2025 intrusion. The driver was loaded via kdu.exe to bypass Driver Signature Enforcement and was embedded as a resource within the MAESTRO orchestrator alongside kdu.exe, devcon.exe, and drv64.dll. Huntress described it as an unsigned kernel driver containing the VM escape exploit.
Operationally, the toolkit used devcon.exe to disable VMware VMCI-related devices (PCI\VEN_15AD&DEV_0740 and ROOT\VMWVMCIHOSTDEV), after which MyDriver.sys communicated directly with VMCI hardware registers using x86 IN/OUT instructions to avoid contention with vmci.sys. The driver queried the ESXi host version using the VMware Guest SDK command "guestlib.stat.get text session" and parsed the ESXi build string. The exploit supported 155 ESXi builds spanning versions 5.1 through 8.0 using build-specific offsets.
Based on Huntress’s assessment, the broader exploit chain likely leveraged VMware vulnerabilities CVE-2025-22226, CVE-2025-22224, and CVE-2025-22225 from VMSA-2025-0004. The chain used HGFS drag-and-drop related RPC commands to leak VMX memory and defeat ASLR, corrupted VMX memory via VMCI, and then escaped the VMX sandbox to the ESXi kernel. It wrote stage-1 and stage-2 shellcode plus the Linux ELF backdoor VSOCKpuppet into VMX memory, ultimately deploying the backdoor on the ESXi host. VSOCKpuppet bound to VSOCK port 10000 and supported file read/write and arbitrary shell command execution via /bin/sh. A Windows VSOCK client (client.exe, also called "GetShell Plugin") was used from a guest VM to communicate with the ESXi backdoor.
The malware was associated with an intrusion that likely began through a compromised SonicWall VPN, followed by lateral movement using a compromised Domain Admin account, RDP access to domain controllers, share enumeration with ShareFinder, attempted password changes via Impacket, and firewall modifications to block outbound external connectivity while preserving internal RFC1918 access. Huntress noted simplified Chinese development artifacts and PDB evidence suggesting development as early as February 19, 2024, indicating a well-resourced developer likely operating in a Chinese-speaking region, though no specific threat actor attribution was provided. The intrusion was stopped before it culminated in ransomware.
Known IOC directly associated with MyDriver.sys: SHA-256 2bc5d02774ac1778be22cace51f9e35fe7b53378f8d70143bf646b68d2c0f94c.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
"Huntress assesses that initial access likely came through a compromised SonicWall VPN."
"...likely exploited three VMware vulnerabilities disclosed as zero-days in March 2025..."
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.