-
A hacking group with ties to China exploited the critical VMware vCenter vulnerability CVE-2026-59310 just days after the bug’s disclosure.
-
Researchers spotted clear evidence of deep access, newly created admin accounts, sneaky tools for backdoor entry, and stolen vCenter credentials.
-
The attackers unleashed a Babuk-style ransomware variant on ESXi hosts, but researchers think the real goal wasn’t encrypting data. The ransomware looked like a distraction than the main event.
A threat actor with possible connections to China is going after a newly patched vulnerability in VMware vCenter, launching a malware campaign that’s hitting hundreds of systems worldwide.
According to the German cybersecurity firm QUIRSO, there’s real evidence tying these attacks back to a Chinese-speaking group. The researchers assessed the link with moderate confidence.
The attacks started around five days after the publication of information about CVE-2026-59310. The researchers estimated that this campaign compromised 361 distinct IP addresses in 47 different countries.
The researchers found that the largest number of victims were in Germany – 55 compromised IP addresses. Next came the United States with 41, Turkey with 38, Iran with 26, and France with 25.
The information adds to the urgency of Broadcom’s warning about the vulnerability. Broadcom issued patches for CVE-2026-59310 on July 29. The company rated it as critical with a CVSS of 9.8.
A Flaw Through Which Attackers Can Gain Root Access
CVE-2026-59310 affects the vCenter Syslog server, letting attackers grab files way beyond where they’re supposed to. Worse—this flaw opens the door for running any code they want.
The attacks don’t require user interaction- no need to click anything, and hackers don’t even need an account. That makes an exposed vCenter server an attractive target.
Broadcom lists no workaround for the flaw. The good news? Patches are available. You’ll find fixes in vCenter 8.0 U3k, 9.0.2.0100, and 9.1.0.0300.
Meanwhile, there’s another bug involved in this campaign too, marked CVE-2026-59309. This one also affects vCenter. The vulnerability lets the attacker access without authentication. QUIRSO observed signs of the attackers using this second flaw on one compromised server as early as August 1.
An account named “vcenter_admin” was later created. The activity started from the IP address 146.59.252[.]178. Researchers pointed out that the account tied to this address wasn’t part of the later attack involving CVE-2026-59310. That suggests the two intrusion paths may have involved separate activity.
Attackers Built Several Ways Back in
Once they exploited CVE-2026-59310, the attackers set up cron jobs. With those, they ran commands as root and took full control.
One malformed cron file had the name “zz-poc59310-syslog.log.” The name they picked seems to reference the vulnerability itself and the proof-of-concept code that surfaced after people publicly disclosed it.
At least one malicious cron file executed successfully. It then installed a backdoor called linuxFile. The malware gives attackers remote command access and communicates with a control server through WebSockets.
The malware can reconnect when its connection fails. It can also establish persistence through systemd and cron. The attackers also used scripts to download a reverse SSH tool. This gave them another route into compromised systems.
QUIRSO found several cron jobs designed to look like normal VMware services. Some added the attackers’ SSH keys, while others installed a JSP web shell.
The attackers also created accounts such as “adminuser” and “vcadmin.” They added one account to the vSphere SSO Administrators group. Another change gave the VMware “perfcharts” account password-free root access through sudo.
All this paints a clear picture: these attackers aren’t chasing a fast ransomware payday. Their main focus is on keeping their access and digging deeper into the VMware environment.
Stolen Credentials Opened More Doors
The attackers also searched for credentials tied to VMware’s internal directory services. Researchers found scripts designed to retrieve information from VMware components and recover machine credentials.
Attackers could then use those credentials to make privileged changes inside vCenter. The attackers also used the vSphere API to learn about the environment before moving toward ESXi hosts.
They created local accounts on ESXi systems and prepared those hosts for ransomware deployment. The chain shows why a compromise of vCenter can be especially dangerous. It is not just another server. It helps manage large parts of a virtualized environment.
Babuk-derived Ransomware may have been a Smokescreen
The final stage involved ransomware that encrypted files on ESXi hosts and used the “.babyk” extension.
That extension is linked to ransomware derived from the leaked Babuk source code. However, QUIRSO has not confirmed whether the ransomware was the main goal of the operation.
Researchers suspect it may have served as a distraction. Encrypting ESXi log files would make it harder for defenders to reconstruct what happened. It could also hide evidence of the earlier intrusion. The use of Babuk-derived code may have another purpose: confusing efforts to identify the attackers.
QUIRSO said it cannot determine whether the ransomware was deployed across other compromised systems because its analysis covered only one infected environment.
VMware Users Face an Urgent Patching Task
The campaign highlights just how risky it is to put off patching internet-facing management systems. Broadcom’s advisory noted that this flaw affects a pretty large number of VMware products: vCenter, ESXi, Workstation, Fusion, Cloud Foundation, etc.
Security researchers have advised organizations to regularly check their systems for any weakness, and also install the latest patches. System admins should be on the lookout for anything unusual, like strange accounts, new cron jobs, web shells, SSH keys, or unusual vSphere API activity.
Currently, the major concern isn’t whether threat actors can exploit the CVE-2026-59310 anymore. The flaw has already been featured in real attacks. The priority now should be how to secure your systems to prevent future attacks.
For organizations running VMware infrastructure, patching vCenter is now only the first step. Before installing the update, they also need to check whether attackers gained access.
The urgency of this approach is underscored by research showing that attackers are weaponizing publicly disclosed vulnerabilities within hours of disclosure. In some cases, groups like Storm-1175 have moved from initial access to data theft and ransomware deployment within 24 hours.
