ESXi VM Escapes, Trust-Based Phishing, and Critical Management RCEs

SISA Weekly Threat Watch – our weekly feature brings to you a quick snapshot of all the major security vulnerabilities that posed a threat to organizations worldwide. These recurring actionable threat advisories will also provide information and recommendations that will help security teams take appropriate actions to defend against the latest and critical threats.

1. Virtualization and Perimeter Boundaries Under Fire

The most alarming development this week is the ability of attackers to “break out” of restricted environments. Whether it is a guest VM compromising a host or a script escaping a sandbox, the assumption of isolation is being actively challenged.

• VMware ESXi VM escape and host compromise chain — Attackers are chaining three vulnerabilities (CVE-2025-22224, -22225, -22226) to escape a Windows guest VM and execute code on the underlying ESXi hypervisor. The attack deploys a “VSOCKpuppet” backdoor that communicates via non-networked VSOCK channels, rendering it invisible to traditional firewalls and IDS.

• n8n Workflow Automation sandbox escape (CVE-2025-68668) — A critical protection failure (CVSS 9.9) in the Python Code Node allows authenticated users to escape the Pyodide sandbox. Attackers can execute arbitrary OS-level commands on the host system, effectively turning low-code automation servers into internal pivot points.

• Fortinet FortiGate 2FA bypass (CVE-2020-12812) — Over 10,000 devices remain exposed to this five-year-old critical flaw. It allows attackers to bypass FortiToken 2FA by abusing case sensitivity in usernames (e.g., via LDAP), providing a “golden key” for ransomware groups to breach VPNs without valid tokens.

2. Social Engineering Weaponizes “System Trust”

Phishing has evolved from deceptive links to architectural abuse. Attackers are leveraging the inherent trust users place in their browsers and the trust organizations place in their own email routing configurations.

• Microsoft 365 internal domain spoofing via routing abuse — Phishing campaigns are exploiting “Direct Send” misconfigurations and complex mail routing to bypass SPF/DMARC checks. This allows external attackers to send emails that appear to originate strictly from the organization’s own domain, facilitating highly convincing CEO fraud and invoice scams.

• ClickFix campaign delivers DCRAT via fake BSOD — Targeting hospitality staff, this campaign uses fake Booking.com pages to trigger a simulated “Blue Screen of Death” in the browser. The error screen tricks victims into “fixing” the crash by pasting a malicious PowerShell command into the Windows Run dialog, bypassing email filters to deploy the DCRAT trojan.

• MuddyWater (APT) deploys Rust-based “RustyWater” RAT — Iranian state-sponsored actors have shifted to a custom Rust-based implant to evade signature detection. Delivered via geofenced spear-phishing disguised as government guidelines, the malware uses asynchronous execution to maintain low-noise persistence in Middle Eastern sectors.

3. Critical Management and Recovery Platforms at Risk

Centralized management consoles and backup infrastructure—the “keys to the kingdom”—are facing critical RCE vulnerabilities that allow attackers to disable defenses or destroy recovery paths.

• Trend Micro Apex Central RCE (CVE-2025-69258) — A critical vulnerability allows unauthenticated remote attackers to load malicious DLLs into the Apex Central service, achieving SYSTEM-level code execution. As this platform manages endpoint security policies, its compromise allows attackers to blind defenses across the entire enterprise.

• Veeam Backup & Replication RCE (CVE-2025-59470) — Authenticated attackers with “Backup Operator” privileges can exploit improper parameter handling to execute arbitrary code on the backup server as the postgres user. This vector is a prime target for ransomware operators seeking to delete or encrypt backups prior to extortion.

Proactive Steps for the Week 

• Patch the “Breakout” risks: Prioritize updates for VMware ESXi (VMX escape), n8n (v2.0.0), and Trend Micro Apex Central (Build 7190+) to close critical RCE and escape vectors.

• Close the Perimeter Gap: Immediately ensure all Fortinet devices are running versions post-6.4.1/6.2.4 to kill the 2FA bypass; verify LDAP case sensitivity settings.

• Harden Email Routing: Audit Microsoft 365 inbound connectors. Disable “Direct Send” unless strictly required and enforce SPF/DMARC alignment on all hops to stop internal spoofing.

• Detect “VSOCK” and “Rust” Anomalies: For ESXi, use host-level commands (like lsof) to check for unusual VSOCK processes that network tools miss. Update EDR signatures to flag unsigned Rust binaries making HTTP connections (RustyWater).

• Block “Clipboard-to-Shell” Activity: Configure EDR/ASR rules to flag PowerShell execution spawned from browser processes or the “Run” dialog, a specific indicator of the ClickFix BSOD attack.

• Isolate Backup Roles: strictly limit “Backup Operator” accounts in Veeam and ensure backup servers are segmented from the standard user network to prevent lateral movement exploitation.