$568 for a VM Escape: Finding MAESTRO on GitHub

The Follow-Up

Earlier today I wrote about MAESTRO, the VMware ESXi VM escape toolkit that Chinese-speaking threat actors have been using since at least February 2024. Huntress published solid research on the toolkit, noting it was "likely being sold privately through closed channels rather than public underground markets."

So I went looking on GitHub.

What We Found

Within minutes of searching, we found a public sales channel.

Repository: XiaomingX/data-cve-poc

This repo describes itself as collecting "all CVE exploits found on GitHub" and has 605 stars and 11,000+ followers. The maintainer claims to work at X (formerly Twitter) and lists a Japanese location with a Chinese company (Jobleap.cn).

Inside the repo, at 2025/CVE-2025-22224/README.md:

Exploit Availability: Not public, only private.
Contact: [email protected]
Download: https://tinyurl.com/34h77mfz

Following the Money

That tinyurl redirects to:

https://satoshidisk.com/pay/CO13UZ

SatoshiDisk is a Bitcoin paywall service. For the low price of $568.25 USD (0.00511552 BTC), you get:

The description matches the CVE exactly: "a critical vulnerability involving a Time-of-Check Time-of-Use (TOCTOU) flaw that enables an out-of-bounds write" affecting VMware ESXi.

The Infrastructure

SatoshiDisk's terms include a helpful disclaimer: they "cannot check uploaded data due to local encryption" and are "not responsible for the content."

Plausible deniability as a service.

The Laundering Pattern

Here's how it works:

Legitimate-looking GitHub "security research" repo
    ↓
README with CVE details + contact email + tinyurl
    ↓
TinyURL redirect (obscures destination)
    ↓
SatoshiDisk Bitcoin paywall
    ↓
Crypto payment, no refunds, encrypted delivery

GitHub provides the SEO and credibility. TinyURL provides the redirect. SatoshiDisk provides the payment processing and deniability. Everyone's hands are clean.

The repo has 11,000 followers. It looks like a legitimate security research collection. Most of the entries probably are legitimate PoC references. But buried in there is a storefront for a CVSS 9.3 VM escape exploit that's on CISA's Known Exploited Vulnerabilities list.

Real or Scam?

Could be either:

1. Real exploit - MAESTRO or a derivative, 5.78KB is plausible for a compact exploit chain

2. Scam - Empty zip or garbage, collect Bitcoin, disappear

3. Honeypot - Real exploit wrapped in malware/backdoor

4. All of the above - Different buyers get different packages

The 5.78KB size is interesting. Too small for a full toolkit with MyDriver.sys and VSOCKpuppet. Could be just the core exploit without the persistence components. Could be a loader that fetches the rest. Could be nothing.

Either way, someone is making money.

The Bigger Picture

Huntress said MAESTRO was being sold "through private channels." They weren't wrong - but there's also a public storefront operating in plain sight on the world's largest code hosting platform.

This is the exploit economy in 2026:

• GitHub for distribution and SEO

• TinyURL for redirect obfuscation

• SatoshiDisk for Bitcoin payments

• Cloudflare for infrastructure protection

• Czech privacy registration for WHOIS

All legal services. All being chained together to sell a weapon.

CVE-2025-22224 has 30,000+ vulnerable ESXi instances exposed to the internet. For $568, anyone with Bitcoin can potentially buy the keys.

What We Did

1. Documented the full chain with receipts

2. Generated a GitHub abuse report (manual submission required)

3. Indexed the IOCs into our threat intel feed

4. Published this post

IOCs

# Seller Infrastructure
[email protected]
thesecure.biz

Report It

If you want to help get this taken down:

• GitHub: https://github.com/contact/report-abuse

• Repository: github.com/XiaomingX/data-cve-poc

• Specific file: 2025/CVE-2025-22224/README.md

The more reports, the faster it comes down. Though they'll just pop up somewhere else.

That's the game.

Her name is Renee Nicole Good.