Chinese-speaking threat actors are believed to have conducted a highly sophisticated, multi-stage intrusion campaign that leveraged a compromised SonicWall VPN appliance as initial access before escalating privileges, moving laterally, and ultimately escaping virtual machine (VM) isolation to compromise VMware ESXi hypervisors. Observed by Huntress in December 2025, the activity involved a custom-developed VM escape toolkit that appears to have been under development as early as late 2023 or February 2024 (more than one year before VMware publicly disclosed the underlying vulnerabilities in March 2025). The toolkit weaponized three (3) VMware zero-day flaws (CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226), later added to U.S Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog. The attack chains information leakage, memory corruption, and sandbox escape techniques using VMware HGFS, VMCI, and kernel-level shellcode to overwrite VMX process memory and execute attacker-controlled code. Key components included an orchestrator binary (MAESTRO), an unsigned kernel driver loaded via Kernel Driver Utility, and a VSOCK-based backdoor (VSOCKpuppet) that enabled persistent hypervisor-level access while bypassing traditional network monitoring. Analysis revealed simplified Chinese strings, Chinese-language development paths such as “All version escape – delivery,” early build timestamps, and broad compatibility across more than 150 ESXi versions, all pointing to a well-resourced Chinese-speaking developer. Huntress assesses that the toolkit was likely sold privately through closed channels and deployed in targeted operations rather than mass exploitation, reflecting a deliberate focus on stealth, pre-positioning, and long-term access. These are TTPs consistent with prior China-linked campaigns such as Volt Typhoon and underscoring the growing strategic risk posed by advanced VM escape capabilities. CTIX analysts urge all administrators to be proactive when patching to prevent the exploitation of known vulnerabilities.