KDU

KDU (Kernel Driver Utility) is an open-source Windows utility used to bypass Driver Signature Enforcement and load unsigned kernel drivers into memory. In the provided reporting, it is not described as a standalone malware family but as an attacker tool embedded or invoked within larger intrusion toolchains. Huntress observed Chinese-speaking threat actors using kdu.exe as part of the MAESTRO VMware ESXi VM-escape toolkit during December 2025 intrusions. In that chain, MAESTRO/exploit.exe disabled VMware VMCI-related devices with devcon.exe, then used KDU to load the unsigned driver MyDriver.sys, which performed ESXi version detection, VMX memory leakage and corruption, sandbox escape, and deployment of the ESXi-resident VSOCKpuppet backdoor. The activity was associated with an intrusion that likely began via a compromised SonicWall VPN, involved use of a compromised Domain Admin account, RDP-based lateral movement, share enumeration, data staging for exfiltration, and attempted progression toward ransomware. The reporting ties the exploit chain with moderate confidence to VMware vulnerabilities CVE-2025-22226, CVE-2025-22224, and CVE-2025-22225. Separately, CrowdStrike reported a KDU module within the Lazarus-linked Gopuram backdoor ecosystem used to bypass driver signature enforcement and load an unsigned driver, which then collected information about installed AV filters and wrote it to C:\Windows\System32\catroot2\edb.chk.log. High-confidence indicators directly mentioned for KDU-related activity include the filename kdu.exe and its use to load unsigned drivers such as MyDriver.sys.