Ant Group’s Security Labs Win Pwnie Awards for Groundbreaking VM Escape Research

Recently, the globally recognized Pwnie Awards—often dubbed the “Oscars of Security”—announced their winners, and Ant Group’s Ant Security Tianqiong Lab together with the Lightyear Lab captured the Best Privilege Escalation award, signaling worldwide acknowledgment of the group’s security research excellence.

The Pwnie Awards, established in 2007, honor information‑security researchers with outstanding and impactful contributions; merely being nominated indicates a research work’s global influence, while winning represents a pinnacle of technical prowess.

Researchers Jiang Yuhao (@danis_jiang) and Ying Xinlei (@0x140ce) were awarded for their paper “URB Sword: Breaking VMware Virtual Machine Escape’s Golden Knot.” Their work demonstrates a method to achieve VM escape across all VMware virtualization products, enabling an attacker to compromise the underlying host machine.

VM escape is regarded in the security community as an exceptionally difficult challenge. As enterprises increasingly migrate to the cloud, virtualization becomes a core technology, creating a virtual layer that allows multiple VMs to run on a single physical host, while keeping each VM isolated from the host and from each other.

In cloud environments, a single host can support thousands of VMs, each handling massive data workloads. Although VMs are designed to be independent, a successful escape that compromises the host poses a severe security incident.

China has accelerated the construction of a digital security barrier and innovation system. According to IPRdaily’s security‑technology patent analysis, China leads the world in total security‑technology patents, with Ant Group, IBM, and Huawei ranking in the top three. Ant Group’s long‑term investments in payment risk control, anti‑money‑laundering, fraud detection, data security, and privacy have built a world‑leading intelligent risk‑control system that keeps Alipay’s loss rate below one in a hundred million for three consecutive years.

Ant Group operates nine security labs; the Tianqiong Lab focuses on risk confrontation, while the Lightyear Lab, a sub‑unit of Tianqiong, concentrates on foundational attack‑defense research. Tianqiong has built a world‑leading intelligent vulnerability discovery and continuous risk verification system, earning numerous accolades at top security conferences such as ACM CCS and Black Hat (USA/EU/Asia).