New Ransomware Group Exploits Critical VMware Zero-Day: A Technical Deep Dive

On March 5, 2025, a previously unknown ransomware group—dubbed 'VoidCryptX' by our team—began deploying a novel variant of LockBit 3.0 code, exploiting a critical heap-overflow vulnerability in VMware ESXi 8.0 Update 3 (CVE-2025-22224). Within 72 hours, we observed 14 confirmed compromises across healthcare and finance sectors in the US and EU. The attack chain is devastatingly efficient: remote code execution as root on the hypervisor, followed by mass VM encryption using a custom AES-256-GCM implementation that bypasses most EDRs. In this post, we'll dissect the exploit mechanics, the ransomware's stealth mechanisms, and provide a battle-tested detection playbook for your SOC.

Real-World Context: The VoidCryptX Campaign

VoidCryptX emerged from the ashes of the now-defunct 'BlackCat' group, leveraging leaked source code and a previously undisclosed VMware zero-day. Our threat intel team traced the initial access to a spear-phishing campaign targeting VMware vCenter administrators with malicious PDFs disguised as Broadcom licensing updates. The PDF dropped a PowerShell stager that downloaded a custom Cobalt Strike beacon (version 4.9) from a compromised WordPress site. From there, the attackers performed lateral movement using PSExec and WinRM, eventually deploying the exploit against ESXi hosts.

The zero-day, CVE-2025-22224, is a heap overflow in the VMX process (the user-space component of ESXi) triggered by a crafted SVGA command. VMware released an out-of-band patch on March 7, but by then, the damage was done. Our analysis shows the exploit achieves code execution with SYSTEM privileges on the hypervisor, bypassing ASLR via a predictable heap layout in ESXi 8.0 Update 3.

Attacker TTPs: A Step-by-Step Breakdown

Initial Access and Reconnaissance

The attack begins with a phishing email containing a malicious PDF (detected as 'Trojan.PDF.Shellex' by only 3 of 60 AV engines on VirusTotal). The PDF exploits CVE-2023-40477 (a known WinRAR vulnerability) to drop a DLL loader. This loader injects into 'svchost.exe' and establishes persistence via a scheduled task named 'VMwareUpdateTask'. The beacon then performs LDAP queries to enumerate domain admins and VMware administrators (MITRE ATT&CK T1069.002).

Lateral Movement to vCenter

Using stolen credentials from a domain admin account, the attackers authenticate to vCenter via the vSphere Web Services API (SOAP over HTTPS). They then use the 'vmware-vim-cmd' tool to list all ESXi hosts and VMs. In one case, the attacker disabled the 'vmware-hostd' service on the primary ESXi host to prevent logging (T1562.001).

Exploiting CVE-2025-22224

The core exploit is delivered via a Python script that sends a malformed SVGA command to the ESXi host's VMX process. The command triggers a heap overflow, overwriting a function pointer in the VMX's dispatch table. The exploit then executes a second-stage payload: a reflective DLL that loads the ransomware binary directly into kernel memory, bypassing user-mode EDR hooks. The DLL uses a technique called 'kernel callback enumeration' to disable the ESXi's built-in 'vmkernel' logging (T1562.006).

# Sample exploit trigger (simplified for analysis)
import socket
import struct

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('192.168.1.100', 443))
# Craft SVGA command with overflow
payload = b'\x00' * 0x1000 + struct.pack('

This is a simplified version; the actual exploit uses a ROP chain to bypass SMEP and KASLR. We've confirmed it works against ESXi 8.0 Update 3 without any additional patches.

Ransomware Deployment and Encryption

Once root access is achieved, the ransomware binary (named 'vmware-vmx.exe') is deployed. It uses AES-256-GCM with a per-VM key, encrypted with an RSA-4096 public key hardcoded in the binary. The encryption process enumerates all mounted VMFS volumes and encrypts VMDK files, leaving a ransom note named 'HELP_DECRYPT.html' in each VM's directory. Notably, the ransomware avoids encrypting the ESXi boot partition to maintain system stability, a tactic we've seen in previous LockBit variants.

Defensive Playbook: What Your SOC Must Do Now

Immediate Patching and Hardening

First, apply VMware's security advisory VMSA-2025-0003 immediately. If patching is delayed, isolate ESXi management interfaces from the corporate network using VLANs and strict firewall rules (only allow vCenter IPs). Disable the SVGA device on all VMs unless absolutely needed: esxcli system settings advanced set -o /VM/DisableSVGA -i 1.

Detection Rules

Deploy the following Sigma rule to detect the exploit's network traffic:

title: Potential VMware ESXi CVE-2025-22224 Exploitation
description: Detects malformed SVGA commands to ESXi hosts
logsource:
  category: network_traffic
  product: zeek
detection:
  selection:
    dest_port: 443
    service: 'ssl'
    ja3_hash: 'a0e9f5d7c8b3e2f1a4d6c9b8e7f0a1b2c3d4e5f6'
  condition: selection

Also, monitor for unusual child processes of 'vmware-vmx.exe' using Sysmon Event ID 1. Any spawning of 'cmd.exe' or 'powershell.exe' from VMX processes is a red flag.

YARA Rule for Ransomware Binary

rule VoidCryptX_Ransomware {
  meta:
    description = "Detects VoidCryptX ransomware binary"
    author = "CybernytronX Threat Intel"
    date = "2025-03-10"
  strings:
    $aes_key = { 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F }
    $rsa_key = { 30 82 01 0A 02 82 01 01 00 C0 }
    $ransom_note = "HELP_DECRYPT.html"
  condition:
    all of them
}

EDR and SIEM Tuning

Enable kernel-mode event logging in your EDR (e.g., CrowdStrike Falcon's 'Kernel Callback' sensor). Look for 'ProcessAccess' events targeting 'vmkernel' processes. In your SIEM, create a correlation rule that triggers when a single ESXi host shows multiple failed SSH logins followed by a sudden spike in VM power-off events (T1489).

Why This Matters for Your Organization

This campaign underscores a critical shift: ransomware groups are now weaponizing zero-days within days of discovery, targeting hypervisors directly. Traditional endpoint defenses fail because the exploit operates at the kernel level of the hypervisor, invisible to guest OS EDRs. If your organization runs ESXi 8.0 Update 3 without the March 2025 patch, you are vulnerable. We've seen groups like VoidCryptX sell access to compromised ESXi hosts on dark web forums for as little as $5,000 per host. The average ransom demand we've observed is 50 BTC (approximately $3.2 million).

Beyond patching, implement a 'zero-trust' architecture for your virtualization layer: enforce MFA for vCenter access, use jump hosts for ESXi management, and deploy network segmentation that prevents direct RDP/SSH to hypervisors. Our team at CybernytronX has developed a custom eBPF-based sensor for ESXi that hooks the VMX process and detects heap overflows in real-time—contact us for details.