China-Linked Hackers Exploit New VMware Zero-Day for Months

A new zero-day vulnerability in VMware products — tracked as CVE-2025-41244 — has been under active exploitation in the wild since mid-October 2024, according to NVISO Labs. The attack has been attributed to a China-linked threat actor tracked as UNC5174, also known by names such as Uteus or Uetus.

The flaw affects multiple VMware platforms, including VMware Cloud Foundation, vSphere, VMware Aria Operations, and various versions of VMware Tools. Because the vulnerability is a local privilege escalation bug, an attacker already on a target system with non-admin access may exploit it to escalate to root privileges.

Broadcom (the parent of VMware) acknowledged the issue in an advisory, cautioning that a malicious local actor who can run a VM with VMware Tools (and is orchestrated under Aria Operations with SDMP enabled) may leverage it to gain root access.

Technical Root Cause & Attack Methodology

At the heart of the issue lies the get_version() function, which is used to match binary names against regex patterns when listening sockets are detected. The problem lies in overly broad regex patterns using \S (non-whitespace) to match binary names — these may inadvertently match binaries in writable directories, such as /tmp.

An unprivileged attacker could place a malicious binary (for example, /tmp/httpd) and cause VMware’s “metrics collection service” to invoke it under higher privileges. NVISO observed UNC5174 using that very path in attacks, spawning a root shell after privilege escalation.

NVISO researchers suggest that this kind of abuse may have existed in other malware strains already exploiting unintended privilege escalations for years, through mimicking of system binaries.

Though the exploit paths demand local access (i.e., an attacker must already have some foothold), the real danger lies in an attacker chaining this to full system takeover, especially in virtualized or cloud environments.

Background: Why UNC5174 Matters

UNC5174 is not a newcomer. Security firms like Mandiant and NVISO have previously linked the group to high-value intrusions, including those targeting Ivanti and SAP NetWeaver systems.

The detection of this new exploit suggests that UNC5174 has expanded its toolkit to include VMware-based escalation. While VMware’s advisory does not explicitly confirm real-world exploitation, NVISO says its attribution is founded on its own telemetry and observations.

Discovering the flaw was credited to NVISO’s Maxime Thiebaut, who reported it on May 19, 2025, during an incident-response engagement. VMware has since issued patches: VMware Tools 12.4.9 (part of 12.5.4) covers the bug on Windows 32-bit, and Linux distributors will push a fixed open-vm-tools version.

Expert Insight & Strategic Implications

Although direct quotes from third-party experts beyond NVISO are not present in the original report, the NVISO team offers critical insights:

• The exploitation method is deceptively simple (regular expression misuse) but powerful when combined with writeable directories and privileged services.
• Attackers mimicking system binaries is a longstanding evasion technique — this vulnerability amplifies such threats.
• The challenge for defenders lies in preventing the initial local foothold and ensuring proper patching or mitigations before attackers can escalate.

From a strategic viewpoint, the incident underscores a recurring pattern in cybersecurity: core infrastructure such as virtualization platforms remains an attractive target for advanced threat actors. Once they gain local code execution, privilege escalation bugs like CVE-2025-41244 offer a high-leverage path to full compromise.

What Should Organizations Do?

• Patch Immediately: Organizations using the affected VMware versions must apply the fixes via VMware Tools 12.4.9 (or higher) on Windows, or updated open-vm-tools packages on Linux.
• Restrict Writeable Paths: Hardening writeable directories (especially /tmp) and preventing unauthorized deployment of binaries may help reduce exposure.
• Segment Access: Treat and isolate virtual machines with VMware Tools and Aria Operations access to reduce lateral movement risk.
• Monitor for Anomalies: Look for suspicious use of HTTPD-like binaries or upward privilege execution patterns.
• Harden Initial Entry Points: Because an attacker must already have some local access to exploit this bug, focus on preventing phishing, credential theft, or supply-chain intrusions.

Conclusion

The discovery of active exploitation of CVE-2025-41244 by a China-linked threat actor is a stark reminder that virtualization infrastructure remains a coveted attack surface. The convergence of a subtle coding oversight (broad regex patterns) with malware persistence tactics (mimicking system binaries) illustrates how even mature platforms can harbor overlooked risks.

For defenders, the path forward is clear: patch aggressively, limit exposure of writable directories, monitor for anomalies, and always assume that local privilege escalation is part of an attacker’s chain — not the final step. In a landscape of increasingly stealthy threats, defense in depth and rapid response remain essential.