← Thursday, October 1, 2026SecurityVulnerability

Attackers used ESXi exploits after likely entering through a SonicWall VPN

huntress.com 17 min read Editor score 7/10

Huntress reports a December 2025 intrusion involving ESXi exploits and assesses that access likely began through a compromised SonicWall VPN; responders stopped the activity. The case underscores that virtualization isolation and basic perimeter access both matter.

What: Attackers likely entered through a compromised SonicWall VPN before deploying VMware ESXi exploits.
How: Using a compromised Domain Admin account, they moved from the backup to the primary domain controller; the toolkit supports 155 ESXi builds.
Why it matters: VM escape can expose every workload on a host, while VSOCK traffic may evade firewalls and IDS, making patching and host-level monitoring important.

The diagram follows the reported attack path from VPN access to ESXi exploitation. Sketched from the article's own text.

Read on huntress.com → Lobsters

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.