China Crew Abused ESXi Zero-Days a Year Before Disclosure

China crew abused ESXi zero-days a year before disclosure

: Huntress analysis suggests VM escape bugs were already weaponized in the wild

VMware ESXi zero-days likely exploited a year before disclosure

Chinese-speaking threat actors used a compromised SonicWall VPN appliance to deliver a VMware ESXi exploit toolkit that seems to have been developed more than a year before the targeted vulnerabilities became publicly known.

Chinese Hackers Exploit VMware Zero-Days for VM Escapes and Host Control

Shadows in the Virtual Realm: How Chinese Hackers Breached VMware’s Core Defenses In the shadowy world of cyber espionage, a new chapter unfolded this week with revelations about sophisticated attacks targeting virtualization infrastructure. Chinese-linked hackers have been exploiting zero-day vulnerabilities in VMware’s ESXi hypervisor, allowing them to break out of virtual machines and seize control at the hypervisor level. This development, d…

Chinese-speaking hackers exploited ESXi zero-days long before disclosure

Chinese-speaking hackers exploited ESXi zero-days long before disclosure

IT Security News Hourly Summary 2026-01-08 06h : 2 posts

2 posts were published in the last hour 4:13 : Hackers Exploiting VMware ESXi Instances in the Wild Using zero-day Exploit Toolkit 4:13 : Quantum-Durable Integrity Verification for Machine-to-Machine Model Contexts The post IT Security News Hourly Summary 2026-01-08 06h : 2 posts appeared first on IT Security News.

Hackers Exploiting VMware ESXi Instances In The Wild Using Zero-day Exploit Toolkit - Cybernoz - Cybersecurity News

Hackers are exploiting VMware ESXi instances in the wild with a zero-day exploit toolkit that chains multiple vulnerabilities for VM escapes. Cybersecurity firm Huntress disrupted one such attack, attributing initial access to a compromised SonicWall VPN.​ Threat actors gained a foothold via SonicWall VPN, then used a compromised Domain Admin account for lateral movement to backup and primary domain controllers. On the primary DC, they deployed …